In my Magento 1.9.3.8 installation. The following happens:
1. Customer signs in
2. Places item in cart, go to checkout, and chooses an address from the address book. Place order.
3. In the confirmation e-mail, and in the Magento back-end, the name and address of another random customer is used. (only the e-mail address is right)

How is this possible? And how can we solve this? 

We have very minimal customizations and extensions. We had recently a lot of spam customer account registrations which we have removed manually. (Now we have enabled the captcha so the spam customer account registration is solved. )