The way it is after a user refistered and verified his email he can change it for a fake one...

Email changes should require verification