I assume you mean that you are only handling people for whom you can confirm their recent php username AND can verify that the specific username connects to/is

I assume you mean that you are only handling people for whom you can confirm their recent php username AND can verify that the specific username connects to/is owned by the same person as the github account provided? Just to make sure that someone doesn't go in and find a PHP account with recent commits, then email you with a third party github account.