imagine you secured your application with oauth2 and several oauth providers.
Now imagine someone using provider A with email email@example.com to log in.
Next time, someone uses provider B with the same email firstname.lastname@example.org to log in.
Both provider state that the email address is verified and both are big companies (no way to specify you own provider or something like this).
Should you map both logins to the same account? What are the risks?
The risks I already see are that the attack surface is getting bigger: if I want to hack the account of Bob, I can try to hack provider A or B. But the benefit would be more convenience for Bob, since he will not have to remember which provider he used...