If you want to make sure that this user is the one they say something outside of Spree, and you need to do it yourself or with the help of an authentic gem.
If you want to check if a given user has a Spree account, it looks like Spree offers this, but you are correct that it is not used by default. From their documentation (my emphasis):
Before starting the verification process, the client will be asked to create a new account or log in to their existing account. By default, there is also a "guest check" option, which allows users to provide only their email address if they do not want to create an account.
, Spree:: Order. spree_auth_devise (, Spree ) check_registration Spree:: CheckoutController ( _), , :
- Spree:: Auth:: Config [: registration_step] true
. Spree . allow_guest_checkout, .