This is clearly a usability vs security decision. The advantage here seems to be that you can receive payments without registering your email, which seems like a nice feature to have. I wouldn't have to keep track of yet another money transfer service (there's already paypal, vemo, zelle), and it's one less account that could get hacked in the future. Also, considering that the recipient's email was probably hacked (how else were they able to get ahold of the email?), even having a mandatory email registration system wouldn't necessarily prevent the fraud from happening. The attacker could re-register your email address to his account, and since he controls your email, he could also approve any verification emails.

From my understanding, this only really happens when the recipient doesn't have autodeposit set up. Still bad, though.