Yup, AFAICS GitHub associates secondary addresses with your account without verification. Although the victim would be notified that their address was added to

Yup, AFAICS GitHub associates secondary addresses with your account without verification. Although the victim would be notified that their address was added to a rogue account, the notification mail says: "If this wasn’t you, please ignore this email." Ugh.