SSO sign-up flow allows creating Users with the wrong username and email address

When the Developer Portal is configured with a Single Sign-on Integration, and a developer signs up via SSO, after the IdP authentication took place, the current default behaviour is for the user to be redirected again to the /signup page where they are requested to confirm the signup form by filling organization, username and email. Here the user can specify arbitrary values for both username and email, resulting in the creation of an Account / User with different details than those of the corresponding user in the IdP.

Apparently this is happening only when the org_name field is missing on the user attributes as documented here. In that case the form should only require to set that field and not allow to change the other details (as it currently does).