Changing account details or payment data or placing new orders requires separate confirmation via mail or phone anyway, so you'd have to have access to the emai

Changing account details or payment data or placing new orders requires separate confirmation via mail or phone anyway, so you'd have to have access to the email account for a chunk of time. If you can do that and prevent your mark from noticing the confirmation mails, you could have done the same with password reset emails.