They're both issues, I agree there, but I think Netflix's screwup is larger here.

Lack of validation means that Netflix is emailing someone asking them to pay for something, who may be totally different than the person getting that thing.