They come in bottles clearly labelled as Surprise Transformation Potion. Not sure if they should always say who the sender is, but there should definitely be some kind of check if they do say that it is who it says it's from. Or maybe tell you to do that? I assume you can trust your friends not to lie and say they ordered a potion they didn't. Peel off the label and another one beneath shows the effects. Bottles are opaque, so you can't guess from the colour. I guess you could still pour it out.
You can order a specific effect for someone, or choose a mystery effect. Obviously it's still labelled underneath, but it means you can get buy them for yourself, or to discover as your friend changes.