I don't know what you mean, that is not going to change what is used to set the cookie, it will set the cookie using what it passed into the ValidateUser method of the membershipprovider and that the membership provider said was valid, and that constructor for SiteUser is only going to find the user using either loginname or email not either/or, that is why sitesettings is passed in so that we know which one to use.
What I don't want to do is make that constructor work no matter which is passed in, that to me is coding in loop holes that I don't want to code in just to accomodate this edge case.
One could call e.Cancel there and then proceed to set the authcookie manually but I don't really want to do that either because it is inconsistent vs other things that use the membership provider such as /Services/AuthenticationService.svc which is a built in feature of ASP.NET much like the LoginControl but can be used in client script or silverlight or desktop apps. And to do that we would still need the constructor on SiteUser to work no matter whether loginname or email is passed in ignoring the site setting. I don't want to do that.
I thought of all the ways it could be done but I don't like any of them. Putting the email in the LoginName field seems to me the most rational workaround for this edge case. I'm sorry you don't like that suggestion but its the only one that seems reasonable to me.