I'm getting a frequent error with Pardot/Salesforce sync: "You're creating a duplicate record. We recommend you use an existing record instead."

I have the connector configured to match by email if there isn't a CRM ID, so I would think that this should handle this case and just link up to the existing record - there should NEVER be an opportunity for duplication with that setting on.

The help documents and other discussions indicate that I should disable/reconfigure deduplication in Salesforce, but that really shouldn't be necessary since Pardot is managing that via email address, right? What am I missing?