You were 100% right! Thanks ever so much! 
I wish I could confirm your theory, but I can’t recall exactly what I did. It was more or less immediately after enabling SSO and trying to log in as my admin user. The email address turned out to be different from the original (pre-SSO) admin user. Therefore I just scrambled to get rid of the extra user that got created in the system.