Facebook OAuth login - ID or email
<p>I'd like to offer our users a Facebook login option. But I'm not sure how to identify existing users (without a stored Facebook ID).</p>

<p>From the docs:
<a href="https://developers.facebook.com/docs/facebook-login/multiple-providers#addingfacebook" rel="nofollow">https://developers.facebook.com/docs/facebook-login/multiple-providers#addingfacebook</a></p>

<blockquote>
  <p>After a successful login using Facebook, you will have the person's
  email address, Facebook ID, and access token. Your <strong>app should search
  for an existing account that has been created with that same email
  address</strong>. If one exists, you should merge the two accounts and add
  the Facebook info to the existing account - as recommended above.</p>
</blockquote>

<p>That doesn't sound like a secure approach to me. What would prevent someone from creating a new Facebook account with a fake email address that matches a user account in my app and then use my Facebook login option? (Obviously, this will not work if the user already owns a Facebook account)</p>