@simon @djh After that first use though PyPI stores more information about the repository and owner beyond the name that would mean renaming can't be abused this way.

@sethmlarson @djh that sounds good enough to me - I expect most pending publishers only exist for a short period of time, and their creators should stay very aware of renames to their own GitHub accounts