Could it be insecure to suggest linking accounts to other identity providers based on their email address?

Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps:

1. Sign in to my site using their twitter account. I request their email address from Twitter, and get bob@megadodo.ursa.


2. After performing some actions, Bob logsout.


3. Some time later, Bob comes to the site again, but forgets that he has an account with twitter, and signs in with Google+. He looks like a new user to me, so I request the email address from Google+, and get bob@megadodo.ursa.

So now, my app can detect that there are two users with the same email address. Would it be ok for me to pop up a message saying "Hey, it ooks like you already have an account on this site, linked to your twitter account. Log in with twitter to merge this account with your old account."?