What is the link between a Self-Service User and the IDCS user?

Summary:

How can I find the link between a CX Contact's Self-Service User and the corresponding IDCS user?

Content (please ensure you mask any confidential information):

How can I find the link between a CX Contact's Self-Service User and the corresponding IDCS user?

We have found out that it's not the email address, because if we change the email address in CX, the address does not get changed in IDCS, but login still works.

So there seems to be some secret GUID or PartyID-based link in the background, but we are not able to find the link from neither the documentation nor the data returned by the REST APIs.