Hi,
Yes, I would indeed recommend using the regular expression check to avoid the issue.
And yes, the check was only done when the address was updated/created until the 4.3.0 when we added also the check of the address being used, as you can read on our change log:
There is now a check to prevent someone from validating a checkout with an old address missing information in required custom fields that were not required when the user first entered his address.
www.hikashop.com/support/documentation/5...ashop-changelog.html
Since you have an old version of HikaShop it's normal that this user, who registered before you had added that check was able to checkout with a post code not validating the regex check.