I have encountered an interesting problem. One of the magento shops I support has a spam problem. A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot captcha of some sort. But what makes the problem interesting is the fact that these user accounts already have a standard billing and shipping address (always billing = shipping address). But the accounts have not been confirmed (email confirmation). So they could not log in to add the addresses.
How can it be that a user has a billing/shipping address without ever being logged in ???
Is there a way to change the default login form and add values to it, which then get added as address ???
Did someone encounter this problem before ???
The store has all latest security patches and we could not find any suspicious files or admin user accounts.
Thanks in advance..