The telemetry portal keys user accounts only by the email claim, so the account follows alex@partner-aero.example when the partner reassigns that address to a new intern. OIDC Core 1.0 section 5.7 names (iss, sub) as the only stable, unique identifier. The Relying Party must also require email_verified: true before it uses email for display or account linking.