NIP-42 allows a relay to send a “AUTH” challenge to the client. The client needs then signs a message with your pubkey and sends it back to the relay. 

This will tell the relay which npub is making the request. If the client then makes a request for DMs that were not sent by them or sent to them, the relay will not provide any DMs back to the client.