When this option
"Lock Raid To Buyer And Friends": true,and those
"Eject Enemies From Purchased PVE Raids": true,
"Eject Enemies From Purchased PVP Raids": true,are set, anyone can just add the owner of the raid to friend list and get the access to raid-base. There is no confirmation needed to add someone as a friend, so it's pretty wrong. You probably should check if the player which is trying to get into base-zone is in owner's list, not on the contrary. So only if owner of the base-event will add someone to his friend-list then he will be allowed to get into