We talked about this at length. The
tl;dr of my reply is that we're not going to spend any more effort making a fundamentally broken system even worse than it currently is, no matter how appealing temporary stopgap measures might seem.
Per your comment, I think it's a good idea to go into some detail as to why we took the feature away, why the system is broken and where we want to go with it. I'm going to try my best to not get too winded here, but there's a bit of ground to cover.
You have a good idea.
I'll start with your idea, and why it's actually a very good one. The worst thing that could possibly happen if a mistake was made is a few strange posts get associated with an unwitting account; this is easy to reverse. If the system required that the email address be the same for the source and target, this would be pretty safe to implement, and that's why I brought it up internally.
But this shows how the system is broken, really broken. We should fix that.
We still end up with moderators unable to use a tool half of the time where some of the time a feature is visible. Say that out loud if you like to get a grasp of just how absurd it actually sounds. When the ability to merge was originally taken away, I strongly recommended that the option remain and just put the merge in a queue where the community team could review and action it. For some reason, we didn't like the idea of another queue at the time, now were coo coo for cocoa
Ideally, we just give the feature back to you almost just as you had it, after improving the facilities we have in place to let users better help themselves and improve the tools that we have to process merges that our users or the system can't handle on their own. There is currently a developer only accounts queue that a few people on the community team can access in order to approve system initiated merges that don't quite match up, this could easily be fed by moderators clicking on the merge button.
You're right, we need to think about why we're being so careful.
We also engineer around the tendency for human beings to make mistakes, moderators now need to click special links in order for things like a user's email address, I.P. address or real name to become visible. This helps to prevent accidental or unwitting disclosure, even by someone looking over your shoulder.
It's very hard to make a mistake when it comes to the handling of personally identifying information.
We need a simpler mousetrap.
Going forward, the sanest thing to do is offload as much of this responsibility as we can for merges to the users that need them, and improve our own facilities to handle what should become exceptional cases when the system can't process their request. At that point, we can just put the option back in your grasp and continue to handle ourselves whatever the system can't.