Your concern is justified, this behavior should not be allowed. Quoting myopenid help page:
OpenID is a decentralized identity system. An OpenID identity is just a URL. All OpenID does is provide a way to prove that you own a URL (identity).
Any additional information associated to that URL is not [necessarily] trusted, unless the OpenID provider also happens to be authoritative to that information (for instance, Google is an OpenID provider and an e-mail provider, so when Google says "the owner of this [google] URL is also the owner of this GMail account" you can trust it). Even those sites that take additional steps to validate the users' e-mail addresses are still not authoritative to them, and the validation only proves that the user controlled the address at the moment of validation (i.e. the e-mail might have changed hands, if it's a corporate e-mail for instance, or the user might have registered with a shared e-mail, etc).
The proper behavior would be either:
- Register two distinct accounts with the same e-mail address;
- Deny the creation of the second account (if for any reason the e-mail address must be unique);
- Offer to link/merge both accounts, requiring that the user authenticates again with the first account, thus proving s/he owns both URLs (the associated info being irrelevant).