GitHub identifies commits only by their associated email addresses, and it is easy to manipulate them. This has a consequence that anyone can masquerade as any others.[1]

[1] https://news.ycombinator.com/item?id=10005577