The authentication account should have a permanent stable identifier that should be the provider's responsibility to issue and manage.
Everything else including email and username should be changeable (provided there's no conflict with other accounts)
replies(1):