many to one mapping in implicit flow

[Marius Scurtescu]

The implicit use case: one party is an email (or phone number) provider another party uses emails for recovery flows. Both parties send RISC events to each other (two opposite streams).

The party that uses emails as recovery can have the same email configured for multiple accounts. When this party sends events to the email provider the SET subject currently specifies only the email address and if RISC events are generated for multiple accounts the stream of events can be confusing to the email provider.

For example, [e-mail] is configured as recovery for both acc1[@rv.example.com] and acc2[@rv.example,com]. If both acc1 and acc2 are hijacked and later only acc2 is recovered then rv.example.com would send the following events: 1. [e-mail] hijacked 1. [e-mail] hijacked 1. [e-mail] recovered

Is the potential confusion relevant? If so, should rv.example.com also send a hash of the account so that tr.example.com can see that event 1 and 2 are for different accounts?