I guess this is bad, right?
Based on the new information that only email address, not physical address, is the authenticator the merchant is using......
It's still only mildly bad.
They're not violating any law. They're not violating the PCI DSS or any card brand regulation that I'm aware of. They're drastically increasing the likelihood that fraudulent purchases will be made on their site, which increases their chargeback liability and (after enough abuse) potentially their ability to process card payments.
It's bad for you in that someone might fraudulently charge your card. You will then need to notice that in your statements and apply for a chargeback. You will get your money back, so in the end, it's an inconvenience rather than a tragedy. You will probably vote with your feet and not use that merchant. Which also damages the merchant.
If you want to help other people avoid that potential fate, you can publicize the name of the merchant. That's probably the only thing that will lead them to change their practices.
Mildly, but for whom?
I don't think there's a violation of the PCI DSS here. The merchant is on the hook for authenticating your identity before they charge your card. Clearly they're doing it somehow; perhaps they consider use of the same email address and shipping address to be "authentication". But the DSS doesn't lay out requirements on how merchants authenticate customers, so perhaps that's a valid method.
Storing your card (encrypted or tokenized) is completely legitimate. Storing in plaintext and displaying the first 6 and last 4 digits are completely legitimate. From the information you've provided, you have no indication that the merchant is doing anything other than storing and using the card in a manner compliant with the PCI DSS.
They are liable for any fraudulent charges to your card, and they will eat the chargeback if someone abuses it (e.g., enters your email and your address and then grabs the package when the mailman drops it off). But that's a pretty limited scenario, it isn't usable by random strangers on the Internet. This attack vector doesn't allow someone to retrieve your information, your card number, or to ship anywhere but your known shipping address.
If people abused this regularly, the merchant's chargeback numbers would go up, they're risk score will go up, and their processor will drop them. At that point, it's certainly bad for the merchant.
In the meantime, you're protected. The card companies will charge back any disputed claims against your card, and you'll get your money back. That's why you're willing to use a credit card, because of the convenience and protections it offers you. If the merchant is doing something that'll ultimately hurt them, well, that'll police itself.