OK, here's what has happened:
Google has indexed 2 unique personalized login links to the BA Miles eStore (and not BAEC) website. As with any other web pages, this can only happen if those links have been publicly posted [presumably] by the respective account holders.
While BA.com developers may wish to come-up with a more 'foolproof' login mechanism, there is no reason for anyone to get alarmed (unless they also intend to post their personalized eStore login links).
Thats what you & I would expect, similar but that is not accurate in this case, two people know the ISSUE, Dilly & I, finder & a BA.com employee.
And Dilly is addressing such.