As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL.
This is a really useful, great feature and makes it very easy to interact with the site without having to remember/sign in all the time.
However, they also save credit card and address details for easy checkout.
So, unless I'm missing something, if a user forwarded one of their emails to someone and say that got forwarded on again, anyone could log into their account, see their personal information and mess with their money. You could also find the URL in a browser's history and access it there.
Is it me or is this a massive security flaw and, if the worst happens, therefore a terrible user experience. The benefits are brilliant but the potential risks seem to far outweigh those benefits.
If I have missed something and this is done securely, how are they doing it?