I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an email address as there's no unique constraint. The theory is that they won't have actual access to the email account so it's not a problem.
I can't think of any issues with this but something about this approach doesn't feel right. The email address is not used as a unique identifier although people log in with it but what potential issues, if any, could rise with this approach?
Edit - Resetting a password doesn't send an email, their theory is that if the user has stolen the phone, they likely have access to the email address on the phone. Instead, they need to enter security questions/answer else they need to create a new account (which is why they want to allow duplicate email addresses). My worry is that this somehow creates a new attack vector for hackers but can't figure out how and I may just be wrong.
Thanks