Great catch.  They couldn't pay with someone else's money, but it's possible that they could modify the shipping address.  I will have to play with this a little to figure that out.