The authentication account should have a permanent stable identifier that should be the provider's responsibility to issue and manage.

Everything else including email and username should be changeable (provided there's no conflict with other accounts)