Adding User Info to Permalink of User pages – is it neccessary?

If such page is available only for users that are logged in (and I guess that’s the point of having “my-account” page), then there is no reason to add anything more to that link. User has to be logged in to access such page and he will be redirected to that page after logging in.

On the other hand it is very important, that you use nonces on any actions, that are performed in these pages – this will protect your users from XSS attacks. And of course, every action performed in there should also check, if user can perform that action (let’s say user wants to delete his order/article – you have to check if current user is permitted to do anything with given article, etc.).