Hey Twitchtoo - I think I may have found a serious "bug" with the how the module interacts with another plugin. I am still working on isolating it, but here's what I suspect.
We are using your Reward Points alongside the One Page Checkout plugin (which allows customers to checkout using a global Guest Account).
I think what is happening is that if Customer A checks out as a guest and earns reward points, it's being assigned to this particular Guest Account. The next customer (Customer B) comes to the site, and when he checks out as a guest, he now has available reward points to use even though he's never shopped here before.
Can you tell me where in your code I can hardcode something that says, "If the Customer ID matches 1234, then don't assign any reward points?"
I think that is the easiest workaround for us. Basically, I can plugin the ID for the Guest Customer (which is always the same), so that if an order is placed using that Customer ID, then no reward points will be rewarded into that account. That way, the next anonymous person who uses it won't get free credit to use.
Thanks in advance.
EDIT - Another option might be to only display reward points to customers if they are logged in. But for now, I need a quick solution to not give away credit to anonymous Guest checkouts (which apparently has been happening in our store for months unnoticed until now).
Currently, I am having a CRON job run a database update every few minutes to zero out any pending/earned points for that Guest Account customer_id, but that's not ideal.