Email Change: Possible Lock Out

[lautarodragan]

It's possible to lock oneself out of the account by changing the email address to an address we don't own.

#875, while necessary, doesn't mitigate this.

The whole change email address system should be more complex — account should keep the same email address, but add new one as newUnconfirmedEmail to the database, and only switch upon confirmation.