Nobody can impersonate a club or family by taking its subdomain. Verification is required before a page can publish or expose private information.