OIDC actually already handles this by requiring the `sub` claim to never be re-assigned and unique: https://openid.net/specs/openid-connect-core-1_0.html#IDToke...
Of course this means that an ID token should not contain an e-mail address under `sub`.