I was involved in building a few decently large e-commerce sites in the early 2000s. One thing I always advocated and we did in a few places was to create an ac

I was involved in building a few decently large e-commerce sites in the early 2000s. One thing I always advocated and we did in a few places was to create an account for a user in every instance. If they ever came back to the login form, they would get a password reset email automatically. One thing that really surprised us: a significant number of return users clicked "forgot password?" before attempting signup. We deduced that they believed they had an account but couldn't remember the password (this was before password managers). When they'd did access their account, it had all their order history, email support history, etc all pre-populated. This approach did not require us to retain any additional data on top of what we would have retained with only keeping their unauthenticated (guest) checkout orders on file.