This bug [#63071834] was caused by a bug in Registration 1.0, which
fires the account_activated signal twice. There's already a pull
request fixing this bug.
In reviewing this handler, I realized that all the other reg code is in
library_auth, so I moved the same_email code there. I also decided that
the utility of attaching to the old email address was insufficient to
over come the risk of people stealing accounts by messing with social
auth.
af8fe05c54