My personal recommendation is to drop third-party logins and allow users to sign-up via usernames (without emails). That means you need to deal with "lost password with no way to recover" situations and spam but it's still better than third parties controlling the most important aspect of your application.