Invite-a-friend from nonmembers

So, apparently when using the invite-a-friend link, non-logged-in nonmembers can fill out the form and get a confirmation message, "Your email was sent." I don't think the emails are actually being sent, but this is a problem - they shouldn't even be able to SEE the invite page. I seem to remember a code that made pages log-in only (and don't suggest page access controls, invite a friend isn't in the list!!) but I'm not sure where it is or if it would work for this page.

How can I make the invite a friend page only accessible to logged in members?

the invite works for nonmembers
this is the default e-mail the person gets

Hello,

I surfed the web and found a cool site: http:// ........ com/
I thought it might be interesting to you.
Some Dude

but if you need to limit access here are two options

Page Access Control add to the list
tellfriend.php

or
in tellfriend.php

after
bx_import('BxTemplFormView');

$logged['member'] = member_auth(0);

If I have my site set to invitation only, doesn't it undermine the point of this if visitors can invite?