Currently the user can change/add email addresses without confirming the address.
The email_confirmer → module allow you to require the user confirms a new email address before changing it.
It would be nice if the two modules could place nice together. I can try to provide a patch if this is something that the maintainers think would be a nice feature.
Active
1.0
Code