Matching on normalized email first and only then on phone is the order I would pick too. The case that still bites us is the same person with a work and a personal address. Do you merge those automatically, or park them for a human to decide?