EmIl address is an identity. The core philosophical issue here is that an identity provider assigns you bucket of identities without your knowledge. Now others who do have knowledge of your assigned identities can take advantage to impersonate you. The idea that it can be resolved by email verification does not hold well because in several circumstances it might not be possible (for example, you need to create your account at the PoS). It’s a bug indeed if you think of email address as identity. It’s unrealistic expectation that all non-technical users should be aware about this feature as well as that all login system must use email verification.

The solution is simple: email provider should let user create additional identities with their knowledge. That is by default dot feature is not enabled but user should be able to go in and create alternative identities that they want explicitly.