This reminds me about the whole `left-pad` fiasco and npm allowing same-name packages to be re-published. For a while I thought that the packages were hijacked [1].

GitHub should definitely not allow username reuse, but most prominently it's a Go issue, where they use GitHub as a package manager.

1 : http://www.drinchev.com/blog/alert-npm-modules-hijacked/