That is what I was proposing.

Likewise linked to this if they change their email address, then they ought to have to verify this.