We are not too strict with it, but we either ask them to come into the IT department, if they still live near the school, or to have a short Google Meet video chat as a check if whoever asks is actually the one they claim to be. This also raises the barrier a little bit for who is asking to actually think what they need to get before they get access, in our experience. We have had a students once impersonate another student to gain access, ever since, this policy has been in place.
After that, we usually give them 1 or 2 days to get what they need, though their account is now limited in terms of who they can see and such. If they come in we usually help them and disable the account again after they leave if that's possible.