This whole story starts from the API token leak into the worst. I think, in a way, Github should reach out to the account holders if it sees a suspicious commit

This whole story starts from the API token leak into the worst. I think, in a way, Github should reach out to the account holders if it sees a suspicious commit is getting pushed with some sort of security algorithm. I think that shouldn't be that hard.