E-mail address requirement not enforced

This report needs expert review. I'm not sure how severe this security issue is, if it is a security issue at all. I'm not a developer but still thought I should report this.

My site had an attempt at a code-injection type attack through the Drupal Commerce checkout form, which also uses this module. The underlying issue may rest with Drupal Commerce itself (which I am running the latest version).

I'm not sure how, but an anonymous user was able to bypass the input of an e-mail address when placing an order. The injection attempt occurred later in the checkout workflow on the Billing Information form. The attempt was not successful, as far as I can tell.

As I said I am not a developer so I have a limited understanding as to how the user was able to bypass the input of an e-mail address and proceed with checkout. I doubt it would have stopped this specific attack, but if there is a way to circumvent that input, then Commerce may be vulnerable to a flood of fake orders or some other kind of automated attack.

Please see the attached screenshots. I am happy to provide more information at your request. And by all means, this could happen everyday to larger sites for all I know. I'm just a small business owner here.

Finally, it's worth noting that this order actually went through all the way to the payment step. It was rejected by my payment processor only because I have strong authentication setup (AVS and CVC, etc.). Without that, this order would have gone through.