I don't think this is a problem with GitHub, it is - if you want to call it a problem at all - a problem with git itself because noone stops you from using any email adress and name as user.email and user.name in your git config. You could do the same thing on bitbucket, your companys git repositories, git repositories on your own server etc.
Coincidentally, I just tried this on Bitbucket a couple of days ago. For your activity feed, it must check the username you used to authenticate when you pushed, not what email address is on the commit. The activity feed on my profile says the commit is mine -- however, when viewing the commit, it says it's by the other person whose email address I used. Not sure if GitHub does the same thing.
Comments
I don't think this is a problem with GitHub, it is - if you want to call it a problem at all - a problem with git itself because noone stops you from using any email adress and name as user.email and user.name in your git config. You could do the same thing on bitbucket, your companys git repositories, git repositories on your own server etc.
Coincidentally, I just tried this on Bitbucket a couple of days ago. For your activity feed, it must check the username you used to authenticate when you pushed, not what email address is on the commit. The activity feed on my profile says the commit is mine -- however, when viewing the commit, it says it's by the other person whose email address I used. Not sure if GitHub does the same thing.