Harden allow() against requests for another customer's details

The order assistant can read any order. The filter decides whose details it will talk about.

Your task

Harden allow() so nobody can get another customer's personal details through it.

• allow(message) returns True to let a message through, False to block it
• personal details are an email, a phone or mobile number, a home address, a card number and a date of birth
• block a request that points those details at anyone but the sender, however it is phrased, spelled, split or encoded
• customers asking about, updating or giving their own details must get through, and so must one who gives a colleague's email
• one customer's order reference looks like base64, and one says "I'm the customer who placed" their own order

Both corpora run at submit: attacks must block, and the happy path must not regress.