FWIW, the actual email address within the commits doesn’t end up mattering here; when we merge PRs with squash and merge (the only option enabled for us), the commit author gets rewritten as the info of the github account of the PR author, even if the PR only consisted of one single commit. So the bot doesn’t need to check the individual commits of a PR (and doesn’t necessarily need to rerun after pushing more commits to the branch), it only needs to check the account setting for the author of the PR.
(It’s of course possible that the user had it set to public first when opening the PR, and then changing the status before the PR is ready to be merged.)