I do get this, and as an Amazon customer, I'm glad this is their stance overall, but on the other hand it seems like they could handle this situation more securely than they do. It seems to me that you could have some sane middle ground where you do no-questions asked replacements, but with some caveats like no ability to change the address the item is being sent to from the original order unless the person you are communicating with can prove they are the account owner.
Maybe have a sort of two-factor system where the CSR can mark the order as "replacement approved" but you have to login to your Amazon account and take some action (just click a confirm button or whatever) to actually send the order out. At least in that case you wouldn't get cases like mine where someone managed to pull a replacement order without (seemingly) ever having actually had access to my Amazon account.