I believe that omniauth is your area of concern, so fix it if you can.  If they attempt to use the same email address though obviously Devise will catch it assuming you are using devise with omniauth.