It appears that twitter does not allow email retrieval to developer at all via oauth
f this link is still relevant I am not sure how discourse can associate the twitter account with an existing account email.
@stuartpb you a pointing out a possible weakness. Discourse should not rely on flowed oauth provider. (not saying that twitter is). If it is known that a common oauth provider does not verify email address Discourse can not rely on the email given by that provider.
But as it appear it is an hypothetical scenario.
also this is not going to solve this concern if the first verified user happened to be the user verified by a flowed oauth provider.
Associating a new endpoint with an existing account should require verification from an already-authorized endpoint.