Yes, they must log into their attendee accounts before booking meetings. These accounts must have already been created by the event manager or by allowing participants to register themselves onto the system.
If attendees were able to book meetings without an account, they could potentially pose as someone else or your event could get overloaded with meeting requests from anyone that has access to the website. Individual, secure attendee profiles allow everyone participating to show exactly who they are before booking or accepting a meeting, as well as letting you know who is responsible should anything inappropriate happen at your event.
We take data protection and internet security seriously, which is why we ensure that every organization and delegate entry is controlled by you as the event manager, and that user accounts can only be accessed by the user themselves or someone they have entrusted with their login details.