Enter invalid email and submit (It will display an error "Invalid email address" and the login link appear)
Click login link to log in (URL in address bar is now
Login using OpenID account provider
You're then redirected back to SO after authentication and it will show you Account Recovery page and it seems you are not logged in
Click any link on that page
It will show you as logged in.
This flow may be OK for you but if my application show this type of flow, I am 99% sure that our (very strict) team tester will report it to our team lead and I am 99% sure that my team lead will ask me not to use
returnurl param in URL any time.