Unauthenticated guest checkout with existing email should not be allowed

Why are you not disabling guest checkout?

Because on this project we want guest checkout.

In Commerce 1.x I believe Commerce Checkout Login could be configured to detect an existing email address and prompt the customer to log in. I think it's a fine feature to add to the log in pane, either in Commerce Core or via a third party module.

Agree with #4, that would be the correct way. And otherwise disallow to proceed with that unauthenticated email address.

Perhaps it can be even seen as security-related, as a guest user without login can add orders to an authenticated user's account? Maybe better to clarify that part as bug?

Changing this to a bug report as of #5 and the risks. I think it shouldn't be configurable in this more or less dangerous combination, as users might not understand the consequences, but that should be discussed.

If the Commerce Guys disagree, please feel free to change back to a feature request.