Then that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require severa

Then that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.