Yes a user can double spend. I can sign any of my addresses to prove who I am.. and be sure to always use escrow guys. That is all.