I actually just noticed this yesterday when realizing that some commits to my personal repository on an unrelated-to-work project had my work account's username and picture, even though I used by personal account key. I guess this uses the global email and name settings, and github matches the picture. I got a bit worried that this stuff would start appearing on my work organization's timeline.