Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned

Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security. If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining. Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information. What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.