I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.
some years ago I reported this issue on gitorious, which yielded an HTTP500 when the repository contained a signed commit:
https://issues.gitorious.org/issues/193 (it's now down, but hopefully it'll reappear on archive.org)
and it'll prevent Launchpad from automatically mirroring git repositories (which is paramount to be able to automatically update PPA with recipes)