While testing draft orders, I determined that if I send a draft order to a particular customer, anybody can follow the "complete your purchase" link to claim that order.
In other words, if I send a draft invoice to email@example.com, and the customer clicks the "complete your purchase" link while logged into my store as firstname.lastname@example.org, then the completed invoice goes onto customer2's account instead of customer1's.
They can also log in during checkout and create a new account during checkout. This happens whether or not the originally invoiced customer already has an account in my store.
Is there any way to prevent this from happening, i.e. require that the draft order is purchased using an account associated with the email address to which the draft order was sent?
(Accounts are required to place orders on my store)