The item of an unregistered user's cart is shown a different unregistered user
The reason for the behavior described above is that in Views I changed the advanced option context filter - order id - for "if there is no value for the context filter" from: "static" (the option after installation, which had the effect that no cart was shown at all) to "show all results" (with the effect described above).

I found this link https://www.drupal4u.org/howtos/how-hide-empty-shopping-cart-drupal-commerce saying the correct value would be "Current user's cart order ID", but this was not available. I'm not sure if this is a bug, if things changed for Commerce 2 or if I configured something wrong.