Email Verification Bypass

Guest Order → Order History Leak (Email Reuse)

Prereq:
- Guest checkout enabled
- No email verification (or bypass)

Steps:
1) Place Guest order with email = [e-mail]
2) Sign up account with same email
3) Open Order History

Vuln:
- Guest order appears in new account → PII/order details exposed