a@gmail.com signs up with google. We also trust github for auth. Github gets hacked and the attacker logs in as a@gmail.com verified by github