I've since learned that this is actually the intended behavior. It's a dangerous
and bad default, and I urge you to change it to be something safer.

Please read the man page:

<heinrichh@uni-duesseldorf.de>
               Using  the email address part which must match exactly. The   
      left angle bracket indicates
               this email address mode.

gpg is not an email program, you email program needs to ensure that proper mail
addresses are used. If you want to be sure to use a specific key, you need to
use something unique; i.e. the fingerprint.

Email addresses on the Internet *are* unique. The option is too easy to misuse,
especially for a security program where selecting the correct recipient is
crucial. But, whatever. GNU.

Right, email addresses are unique, but the key-email association is not unique.