That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email.

It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).