Git internally identifies authors by email addresses. Github doesn't display the addresses in the web UI, but they're still present in the repository and can be extracted. Github can't prevent this because the author is part of the identity of the commit -- rewriting it would change commit IDs.
