User identity matching in the `UpdateUser()` function (located in internal/users/manager.go) resolves logins using a broker-scoped provider ID. If the provider ID is not recognized, the system falls back to matching the username without rejecting conflicting non-empty provider IDs. If an identity provider reassigns an email address (used as the username) to a new account, that new account inherits the local UID and home directory of the previous user upon login. This allows the new user to access and modify the previous user's files, including SSH keys and cloud API tokens, while silently rebinding the local account record to the new identity.