Why you dont secure your portal more for buying tokens?
We have 2-factor authorization. Use it, if you want to provide maximum security. It will also protect withdraw address change, it will be impossible to change withdraw address without entering one-time code.