What are the implications of letting oauth2 users change their email addresses?

Not sure, I guess the only other thing you should be aware of is that we build an admin interface for merging accounts… so worst case if you discover an issue you can sort it out yourself.