External SSO External ID not recognised

[sam (Sam Saffron)]

Well we key on email as well, so if you send us the same email address we automatically take over the account.

Sounds to me like you have untrusted emails in your sso origin. Is that the case?