The Track my Order page asks for an order number and the email address of that order. It uses the same protection as the password forms: failed lookups are counted per IP address for one hour, and only a hash of the address is stored, never the address itself.

The two forms count separately, so somebody guessing order numbers cannot lock a visitor out of a password protected Event.