Billing information appears to be tied to the email of the customer. This is stupid.
We are using our own email to process certain types of orders. When doing this, we saw someone's order change to another entity's order. We then, to test, sent in another email using "Justin Beiber" as the (fake) recipient and biller. The 5 orders from two companies both now showed Justin Beiber as the bill to. This is not acceptable. What if a person/company has a new billing department email? They just loose all their past orders?