A malicious party could have access to OP's other accounts, maybe OP reuses passwords. It's in the realm of plausibility that they are being cautious not to al

A malicious party could have access to OP's other accounts, maybe OP reuses passwords. It's in the realm of plausibility that they are being cautious not to alert the attacker. If they/authorities want to use the opportunity to observe and collect evidence then I think these actions on GitHub's part are somewhat reasonable, albeit kind of shitty.