I've just tested this and thankfully I wasn't able to recreate the issue.
In your settings for the 'Existing Contact' component, please could you check that the 'Enforce Permissions' checkbox is selected? It should be ticked by default. This should prevent viewing of other peoples' data.
We recently did a fair bit of work on multiple multi-value fields and that issue is fixed in the latest and tested by a UK partner and his client:
Fixed in 8.x-5.x - secured with a test and backported to 7.x-5.x - so it will be fixed when we push next releases to drupal.org
If you think that’s awesome 🥳 - you can ...