From what I can tell poking around the source code, it appears that Bors will use the GitHub user's public email (since that's what the GitHub API uses) when committing as a user. I think it may apply to both the Author and Committer fields, but I could be wrong.
We're hitting issues with users who use GitHub for both personal and work use, where they have a public email set to their personal email and it is appearing as the author and committer when Bors does the squash merge. (When doing this from the web UI, it uses the GitHub primary email and not public email.)
Is this an issue others have hit? Is there any way around it? Note that this works fine for those without a public email, so if it somehow just ignored the public email that would fix our issue.