Comment 1 for bug 556594

We cannot confirm that RPs have used these identifiers. That is information that the OP has, not us.

And in the end, we don't really care. We trust the OP, so if the OP comes back and says that the user has identifier XXYYZZ and that their email address is <email address hidden>, we should:

a) create an account for that identifier, if it doesn't exist
b) create the <email address hidden> email address, if it doesn't exist

But if the email address already exist, we should simply link the account to the person record owning the email address.