When you change your account email address it sends an email for you to confirm the change.

But this email goes to the new address, not the current address.

So it's therefore trivial to take over somebody else's account and change the email address to your own, because they don't have to confirm it.

You really need to send the confirm change email to both.