When a simple user is deleted from QuickConnect, the PayVault user associated with that id isn't deleted. So potentially, a user with username mark could create an account, delete than account, then someone else could register a new user with username mark, and that new mark would have the original mark's vault.
Update: I just tested this and it works how I described above. My register new user server code credits a user with coins and some starter items. When I delete the user in QuickConnect, and then create it again, the same vault object is used, and so now the newly registered user receives all the new user benefits again.
Edit: I suppose this is only a bug if there's not a way to delete PayVault users. Perhaps there is and I'm missing it?