As a moderator, I've seen some users lost their unregistered account and create new account. So I'm testing unregistered account behavior to help those users.
To simulate those users, I've tested with same email address and different browsers.
- I've asked as an unregistered user (A) with browser A, then I got 'Thanks for your post on ...' email.
- Some days after, I've asked with same email address but browser B, then I got another unregistered user (B) and 'Thanks for your post on ...' email.
- I clicked 'Set your password' link on the email for (A) from browser C and set a password.
- Then I should be logged in (A), but it was another account (C).
Also, /users/account-recovery sends me same link as 'Set your password'. This means, if you created many unregistered accounts for one email accidentally, these features will be useless for account recovering.
and IMHO, allowing multiple accounts (even if it's unregistered) is a root cause...