For some reason Amazon attaches your Amazon Account to all Amazon devices bought with your account. So whoever buys it is able to order anything using your saved info. He can't change address without confirming a card, but he can use it to order digital items where the address doesn't matter. Don't ask me why Amazon does that, I'm pretty sure that they may be liable for fines for each violation of PII, but be sure to deregister your device.