I agree, I know people are trying to find someone to blame but in all honesty this isnt the first time Ive been spammed through Github thanks to being associated with Epic on there. The way I see it is this person must have had both an Epic and Github account, that there is no real checks on anyone creating Epic accounts (Github Im alittle less concerned about for obvious reasons) and no sort of protections like account aging.
The I see is that Epic are adding features to the launcher to protect their login servers while not protecting account creation process barely at all, now you want to make it easy for people to sign up but you need to think about your 2 million active users too whose security is important. Im just glad this exploit wasnt that far reaching and I think Epic do need to take security seriously because next time an “oops, here fix these settings” might not be enough 