A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a registered shop user, the guest order shall be associated with this user account.
Would it be secure to associate the guest order with the user account automatically, without requiring the guest to login beforehand (to prove that the guest is the one claiming to be)?
What could happen (in the worst case) when the guest has malicious intent?
Scenario: Alice is registered with her mail address. Bob knows this and orders something [providing shipping address and payment data of him|Alice|someone else] as a guest, entering Alice’s mail address.
Social engineering would be the only attack vector that occurs to me here. Which might be especially painful when the guest selected payment in advance (resp. per invoice) and the user is somehow tricked into paying for an order that gets shipped to the guest.