If we were to limit reviewing to the person named on the bill and no one else, we feel that travellers would miss out on a wealth of other useful feedback. For instance, a reviewer may want to share a customer service experience that did not include an overnight stay, or review a hotel stay someone else in their party paid for.
Why doesn't TripAdvisor use name authentication or require proof of stay?