Wild Apricot's documentation reads as if you must be logged in as a member to use a Member-restricted Ticket Type.
Their
Advanced events — Ticket types & settings tab help page says:
Depending on whether they are logged on or not, some member-only ticket types may not be available. If they are not logged in, but their email is stored in your contact database, they will be prompted to log in.
When you start a registration not logged in but using a contact email address, it displays this message in a box with a “Login” button: “Your email is already in our database. You can log in to auto-fill your contact information – and enable any member-only ticket types – or proceed with the registration without logging in.” This also suggests that you must be logged in to use a Member-restricted Ticket Type. However, if the email address is for a member, then any member-restricted ticket type is already select-able without you being logged in, which contradicts that if you notice the Ticket Type is select-able.
When you start a registration not logged in and using a non-contact email address, it displays this message in a box with an “Apply for membership” button: “Note: some ticket types are only available for members.”
So the reality is that to use a Member-restricted Ticket Type you only need to enter a current member's email address when you start the registration, then at the next step Wild Apricot will let you choose a Member-restricted Ticket Type even though you have not logged in.
Note that a contact must be logged in to have it automatically fill in their contact information for the registration, or to use their stored credit card to pay.
But when not logged in, they can register with a Member-restricted Ticket Type by filling in the registration information by hand, and can pay for it if they supply a credit card. The resulting registration and payment will be recorded as if made by the member whose email address was used, despite no login.
However, the registration email address will be the members email address, which is what allowed the use of a Member-restricted Ticket Type in the first place. Thus, the member will receive all the email(s) about the registration(s), making it clear that it happened.
This behavior causes several security vulnerabilities in Wild Apricot. Note that ALL Wild Apricot-based websites have these 2 security vulnerabilities. Since Wild Apricot is widely used, it's less unlikely than you might first guess that someone expend the effect to exploit these vulnerabilities,
First, someone could use this behavior to discover if an email address is a contact, or if it is a member.
Second, someone who knows a contacts email address can create registrations as if them, despite not knowing the contacts password, and there is no record of who actually did it. Registrations created while not logged in can easily use any name, since Wild Apricot does not require that the registration name or the the payer name be the same as the members contact name. Likewise for the address.
Thankfully, the name or address entered for a registration does not replace existing contact information, only exists in that registration.