It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.)

"Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)

He changed his git config so that user.email was [email protected] (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by [email protected], so let's put his avatar there and link to his profile as the author."

Changing the config is as simple as

    git config user.email "[email protected]"

And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on.

Edit: There's also some way to do it with a --author= flag when you commit.

You have it correct. What you say in your second sentence is exactly the issue.

If this is "actually" a big issue or not is another question.

Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.