What's in authour/commit meta is orthogonal to which github.com account you are actually using. Anyone can commit as anyone as long as you have any way to push and if you want better than that you need signed commits. There are no "ephemeral accounts" in play here.
git require name and email to commit, but there's no cryptography involved there. Maybe GitHub won't green the lawn for unverified third party commits included in pushed commits?