It is rather unfortunate yet at the same time unsurprising. :(<p>Two years ago I found out that Amazon allows multiple accounts to be set up using the same email address with different passwords (!!!) - which means that the potential attack vector is larger for no good reason.<p>I don&#x27;t recall how this happened but I can only assume at the time I signed up to AWS and I might have reset&#x2F;changed the password somehow that resulted in the system creating another copy of my account.<p>So all the information (credit cards, addresses, etc) of the &quot;old&quot; account still existed until I deleted them. But let&#x27;s say if someone who has no idea that they have more than one accounts with Amazon, they could easily leave their information intact in their &quot;old&quot; accounts, which if they have weak passwords can easily be compromised.<p>Unfortunately Amazon did not take this report seriously, and to this very day this issue still persists.