Just to round this out, we discovered it was the SSO flow not verifying the emails before passing them to Discourse.