I understand the potential risk.
Maybe for an old forum migrating to NodeBB can be useful to merge some account from the admin panel in the case one want to login using social where they use a different email.
The best solution would be to expose your login process as an OAuth endpoint, via something like OAuth2orize, and then install a corresponding fork of this SSO plugin to talk to your endpoint.
