I thought that too, or that they could ask what the last order was instead of asking for a simple yes/no answer… but no, they should not, they should never give out personal information without a valid login, period.

Anything less is a huge security failure.