I did that for a side-project a few years back. This was very elegant to implement: I was happy not having to store any password hashes (which is a dangerous th

I did that for a side-project a few years back. This was very elegant to implement: I was happy not having to store any password hashes (which is a dangerous thing to store as password reuse is prevalent) while still ensuring that my users had a secure way to interact with my service. Still, this confused the heck out of some users. Some people kept forgetting the email address they used to sign up and were asking me why their account had been 'duplicated'. I had deliberately blurred the line between signing in and signing up and in practice it backfired a bit. I would not try that for a mainstream service nowadays.