OK, here's what has happened:

Google has indexed 2 unique personalized login links to the BA Miles eStore (and not BAEC) website. As with any other web pages, this can only happen if those links have been publicly posted [presumably] by the respective account holders.

While BA.com developers may wish to come-up with a more 'foolproof' login mechanism, there is no reason for anyone to get alarmed (unless they also intend to post their personalized eStore login links).