[laurensr]

So users can add other users' SSH keys (sourced from GitLab, ....) to their GitHub profile, essentially depriving the actual key owner from using GitHub

[basilgohar]

But then that opens them up to having their victim commit code to their repos directly, as well.

[yencabulator]

Not a big deal for an attacker to create a dummy account.