When registering someone else for an event logged in user is registered under some circumstances

If the person being registered has the same email address AND the event is not set to allow multiple participants from the same address then the loggedin user is registered - despite the url (cid=0) indicating that the intention was to register someone else.

The combination of these 2 lines

https://github.com/civicrm/civicrm-core/blob/master/CRM/Event/Form/Registration/Register.php#L1402
https://github.com/civicrm/civicrm-core/blob/master/CRM/Event/Form/Registration/Register.php#L974

cause this.

NB - when choosing to allow multiple emails the message is

"Primary participants will be allowed to register for this event multiple times. No duplicate registration checking will be performed."

My reading of the code is that standard de-dupe rules are actually applied in this instance (which makes me wonder about the email only check - it seems that this maybe should be set to allow by default as the behaviour with it checked (if my reading is correct) seems like what one would expect - ie. if you set your dedupe rules 'loose' you do that for a reason