it shows the order and ALL orders

I am using Commerce Order: order confirmation mesage type to get a lovely html confirmation message emailed to customers. BUT unless you go to permissions and click 'View own Order orders ' the order detail does not appear in the email.
This would be fine but for another strange side effect that if you then logout and paste any order url into a browser eg http://localhost/shopmin02/user/7/orders/9 it shows the order and ALL orders. I know that Kickstart forces users to create an account BEFORE checkout - is this the reason?