It is rather unfortunate yet at the same time unsurprising. :( Two years ago I found out that Amazon allows multiple accounts to be set up using the same email

It is rather unfortunate yet at the same time unsurprising. :( Two years ago I found out that Amazon allows multiple accounts to be set up using the same email address with different passwords (!!!) - which means that the potential attack vector is larger for no good reason. I don't recall how this happened but I can only assume at the time I signed up to AWS and I might have reset/changed the password somehow that resulted in the system creating another copy of my account. So all the information (credit cards, addresses, etc) of the "old" account still existed until I deleted them. But let's say if someone who has no idea that they have more than one accounts with Amazon, they could easily leave their information intact in their "old" accounts, which if they have weak passwords can easily be compromised. Unfortunately Amazon did not take this report seriously, and to this very day this issue still persists.