This is a plausible attack vector, parallel to the profiles Facebook, Linkedin et al maintain for people who don't have accounts.