This is actually multiple bugs, but can be reproduced in a single flow.
How to reproduce:
1. Create a new studio with a single test title.
2. Go to the API documentation for RegisterPlayFabUser and select the "try it" option.
3. Use the test title and supply: TitleId; Email; Password; RequireBothUsernameAndEmail = False;
4. Go to the game data and look at the players - there are two created with the same timestamp. The first claims to be created with a custom id and the second is the correct user created with the email address (organic). I'll call these play fab ids XXXA and XXXB respectively. The organic user playfab id XXXB is returned in the response.
5. Go to the API for LinkCustomID and link the PlayFab Id (as a custom id) to this user using XXXB for the custom id. This appears to work correctly.
6. Go to LoginWithCustomID and log in using XXXB - this now unexpectedly returns the other user, XXXA - you are now logged in as them.
7. Go to LogInWithEmailAddress and log back in as the correct user using the credentials from step 3 - the response shows you are now XXXB.
8. Go to LinkCustomID and try to link XXXB - this should fail because it was already linked to XXXA, but it succeeds.
9. Go back to LoginWithCustomID and use XXXB to log in - you are logged in as XXXA.
