When a user changes his email address then a confirmation email is sent to the old email address and not to the new. It should be the other way around. A confirmation email should be sent to the NEW email adress to confirm that the NEW email is valid and working. And email may be sent the old email address as well to inform about the change. But it should not be a confirmation email to the old email address. Every so often we are contacted by users that no longer has access to the email address then registrered their user account with. And when then want to change the email address to a valid email address they can't as they don't have access to the old email address any longer. Another issue is that users now can enter an invalid whatever email address instead of the valid email address they registered with which will result in us having fake and invalid email addresses in our database. This is a must change!