Aye, so others have informed me. Never understood why the loop isn't closed on this kind of thing. I am also willing to be that the order number isn't verified.
Or maybe they just to a few randoms here and there, but with modern systems doing the checks _should be_ trivial. Obviously, apply a wee bit of wiggle room for delays in the post etc.