Yep, I was shocked.
Yep, scary.
You can also specify which mail you want a COA for, and for what period of time, or if it's a permanent COA. So, let's say I live with three other people at the same address. I can change my mailing address for myself, or someone else in my household- or for everyone in the household all at once. Or for specific mail. All it takes is one forwarded piece of sensitive mail to another address to open up the door to fraud.
Incidentally, you can also change the registration on vehicles this same way if you have multiple residences. Pay your taxes in a county where you have a home registered in your name, and you can set it as temporary or permanent. Won't conflict with your license (wherever your license might list as residence) and your only obligation is to pay the vehicle taxes in that county to keep your tags up to date.
This is also true for boats and trailers.
More food for thought.