It's a quirk of the authorisation system - my local .git/config had in my alt accounts email and username, but I logged into github with my normal account and password, so it set the change from an anonymous account, but allowed it without a push request because I used my credentials.

I blame this for commiting stuff which it shouldn't have committed. Or maybe it was somebody on github being a swine 'cos I publically PoC the client exploit :-)