In most scenarios the DNS host and the web hosting provider are not the same thing. However, as you point out it is possible for them to provide both services. I'll cover both scenarios for future readers:
Separate Host and Registrar/DNS Host
In this scenario it's not possible for the domain to be hijacked as the user would have to be able to make changes to the name server that hosts the DNS to point it to a different IP address. With this in mind no verification is needed, if a user uses your domain name when signing up for a shared hosting service the host could care less because the domain will never be routed but the credit card hosting the server will most certainly be billed!
This is a little trickier as you have to rely on the hosting provider to sort it all out. Most of the web-based control panel systems will compare the domain name entered when you sign-up, if the domain is already hosted it will not let you continue. But as ceejayoz points out above, this really comes down to a per-provider question. The chances are relatively small that this could happen though given the basic security use case.