When a PR is integrated using the /sponsor command, the bot tries to resolve the author of the final commit from the last commit in the PR source branch. In some cases, this commit could have been authored by someone other than the PR author. Here is one such example where Magnus provided an additional commit that the author just imported and pushed to the PR source branch:

https://github.com/openjdk/jdk/pull/7242/commits
https://github.com/openjdk/jdk/commit/6de90ad9800b83c4a5f364c3645603fcb6828d6c

The consequence in that instance was that Magnus' got credited as author (as well as committer) but with his private email instead of the openjdk one.

It seems to me, that in the case of a sponsored PR, we should at least try to get the name and email data from the GitHub user who authored the PR before perhaps falling back to using the author from the last commit.