Annonymous user able to manipulate contact data trough contribution page

It is possible to manipulate or destroy the saved data of an contact record just by signing a contribution

To recreate you need a profile with name and address or other user data, connected to a contribution page.

The attacker has only to know the victims email address. Because there is no other security barrier, the data record will actually mediately destroy the user record by replacing all old data.

This is actually a very stupid behavior for anything that tries to be an professional solution of some sort.