[upgradeind]

Thanks for the insight about email addresses, I hadn't considered that. I know from personal experience that I usually get new addresses but rarely abandon old ones.

I wonder if providing the option to use a phone number OR an email address to receive the code be a good fail safe?

[moviuro]

I'd be less inclined to give my phone number to a random shop on the Internet myself.

Regarding access to the old invoices, maybe ask for the zipcode instead of a password? (my local post service does that to track a parcel for example)