I think we should throw an exception here if the user isn't logged in, as we ensure that on a previous step.
Maybe the best way is to simply call $this->getUser() (implemented in the Controller class of FrameworkBundle):

    $order->setUser($this->getUser());