See PHI2015. Diffusion attempts to prevent a commit's author from being made an auditor, but currently uses an out-of-date method for identifying the author.

Use the modern ("Repository Identity" aware) method instead.

• Authored a commit as user "X", mapped to my account.
• Pushed/imported/discovered it.
• Changed the identity mapping for "X" from my account to a different account.
• Tried to add myself as an auditor.
  • Before: error, "author can't be an auditor".
  • After: succeeds.
• Tried to add the newly mapped user as an auditor. This correctly fails with the "author can't be an auditor" error.

It's possible to put commits into a wonky state by remapping the author identity to a user who is already an auditor, but I think that isn't important and we can't do much about it, realistically.