You're absolutely right about passwords... Just I thought I could be notified of possible duplicates without knowing them (as hashed in 2.2.x) ...
Later, the Admin could evaluate or investigate better tracking those user this way identified...
The other thing, the email: well, my board has about 30 new users a day, but most of them are only 'readers' cause login/pw are necessary even to reach the forums, then I use email verification and admin validation to find potential dupe users.
Till now I always did this way: about once a month, I close the new subscriptions for a day, download the user.csv to excel and sort again and again with small function utilities to find 'probably' matching (at 90%...

) userid, emails, md5(pw), ipaddress, and so on... Most dupe email are similar id on different servers (yahoo, hotmail, etc.) or 'soundex-like' ids on the same one...
Then I always found out about 100-200 potential dupe users (I experimented the most popular sport is, when forgettin pw, re-subscribe again and again...

), and if in doubt contacted them to choose the right one...
As you can see, your great hack seems solving almost my problems...
That's all ... Thanks for support.