Some suggestions:
If customer request a password (when he is a guest), then an error message should be displayed even when his email exists.
No links should be sent in any email when the customer is a guest. especially if you are using OSCommerce's default email template.
Another thing I noticed is that Guest Account creates an implicit account, but when a guest comes back and checks out (as a guest) with the same email, another account with an invalid email address ( some extension appended with the valid email address ) is created so that the guest will not receive any email.
Any justifications on that weird email extension ?
Feedbacks on the above points are welcome.
Again, I am not trying to be critical, I thought the contribution is great. In fact I am trying to close all the loopholes. I'll even program it and contribute it when it's ready.