When you design an online CD ordering facility for free CDs that doesn't require any authentication of the customer, you really should make sure that people don't have the ability to abuse your system and order unlimited numbers of CDs for themselves (or someone else). It seems common sense, and yet some people don't feel it worthy of consideration.
I know, I know — you're wondering who would be so stupid as to allow someone to order 150 copies of your free CD and then not put in place measures to stop them from being delivered (didn't you read the title?). While there do appear to be a few, I expected more from Microsoft (update: the forum thread seems to have been deleted as it was consuming too much bandwidth — I wonder how much it ended up costing Microsoft). Even I wouldn't have thought them that silly (and that's saying something).