title: Security issues of letting a user being able to change their email address?
body: <p>I'm developing a web app and currently I'm trying to decide whether or not to let my users to change their email. </p>
  
  <p>If an account gets compromised the attacker only needs to change email and then reset password to gain complete control of the user account. However with no ability to change email address, the user can regain control and simply reset password to stop further rogue access to their account.</p>
  
  <p>What do you think?</p>