Based on the information given, I don't know if you can really impersonate people. Rather, you can give an arbitrary email address and have it represented as va

Based on the information given, I don't know if you can really impersonate people. Rather, you can give an arbitrary email address and have it represented as valid, _against your account_. You need an additional bug on the relying party for this to allow someone to gain access - that they associate the apple account based on the unstable email address claim rather than the stable "sub" claim.