I am not sure, but that’s what I’ve done to solve similar problems with imports. The other solution is to muck with the SSO mapping at the console, which is beyond what is typically feasible here.
Deleting U2 and changing U1’s email address to the SSO email address should work, I’d think. Why this didn’t work seems like a separate issue, but could be the safest way to go.