FWIW, some sites—like Amazon—allow multiple users on the exact same email address (distinguished by password or other identifiers)
If I log into AWS using one account (the one I've had for Amazon.com for more than a decade), I get the console with no resources in it. If I log in with the same email but a different password, I see all of my resources. Absolutely insane.
Could you effectively DOS an account by creating thousands of shadow accounts with different passwords?
The login handler is only going to try to bcrypt so many times before timing out.