Thanks for help, now I understand I have to make the SSO managing the email address, and turn off email editable, to prevent the situation that users can transfer accounts simply by editing email
.
Currently, some users want to add Secondary Emails, but someone used this feature to transfer accounts
.