don't allow multiple users with same email

Question

I've got a site using Commerce. On checkout a user is created to allow access to files, order history etc.

I just had a customer that couldn't find his files and discovered that he had two accounts registered to the same email address. So it seems my system isn't checking for accounts already registered to the same email address.

How can I make sure that

1. There's only registered an account in the event that the email used for the order haven't been used on the site before?
2. If the email has been used before the new order is attributed to the existing user?

Edit

After reading @Neograph734's answer below I checked my rules. And they look right to my eyes, so I'm a bit confused as to what can cause this:

Weight 1: Assign an anonymous order to a pre-existing user

Weight 2: Create a new account for an anonymous order

Answer 1

Drupal by default does not allow multiple users with the same email if you try to create them through Drupal forms. If users are created by code this check is not performed.

My best guess it, that this caused by one of the rules Drupal commerce ships with. Specifically the "Create a new account for an anonymous order" rule. This rule fires when a user who is not logged-in completes checkout. It should check if the email is already registered, but might have been altered. Alternatively you might have a similar rule created yourself or by a module that does not check if the e-mail is already existing.

Most of Drupal commerce's behavior is controllable by rules, so I'd start looking there for rules that create users.