According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the existing contact. While this helps to prevent contact duplication, it seems like it could also represent a potential security problem.
A simple scenario: a membership organization has migrated their existing CRM data to CiviCRM. They would like new members to be able to sign up online, so they allow anonymous Drupal user account creation. Existing members are encouraged to create Drupal users (which get automatically associated with their CiviCRM contact information) so that they can renew their memberships online.
In this scenario, what prevents a malicious person from using an existing contact's e-mail address during Drupal user registration? Using an existing contact's e-mail address (which can be assumed to be fairly public information) would potentially give the malicious person access to all of that contact's personal information, and (if Rules synchronization is implemented) access to other parts of the website they shouldn't have access to.
This appears to me to be a security hole with the potential to expose personal information; am I missing something? How can this be mitigated?
