Same way they do other verifications I suppose; by proving you have write access to the server in question. If someone malicious can manage that, there's bigger problems than SSL.

Presumably it still checks the certificate is valid otherwise the worse case would just be that the legitimate site would not work.