Why is $e=0$ allowed in Schnorr signatures?
Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed?


Because $e = 0$ is not unique in this regard. Every single $e$ is equally "insecure", i.e. you may as well ban $e = 23$ with the same reasoning. 

To exemplify, assume $e = 23$ arbitrarily (holds for any value of $e$ with the same reasoning). For that $e$, I can easily compute a signature by choosing a random scalar $0 \leq s &lt; n$ and computing $R = sG+eP$. By definition, $(R,s)$ is a valid signature. 
For $e = 0$, this is probably the attack you had in mind. 

Of course, in reality this attack is not going to be successful because if I try to choose $R$ "cleverly" for a specific $e$, with overwhelming probability this is not going to be the $e$ with $e = H(R||M)$ (assuming the hash function is good). The trick here is that $e$ is only fixed after $R$ is already chosen, which makes it secure.

There is a deeper reason behind all this linked to the security proof, which does not at all care about any $e$. I'm not doing the proof justice with the following sketch, but very, very, very roughly, the reduction runs the attacker twice: once with $e$ and once with some other hash value $e'\neq e$ (modeling $H$ as a random oracle). The reduction only requires $e - e' \neq 0$ (which is the actual "weak spot 0", but it only occurs in the security proof) to compute the signature's secret key given a successful attacker. If you are interested, I recommend a look into Pointcheval, David, and Jacques Stern. "Security arguments for digital signatures and blind signatures.