It seems to be a common antipattern for somewhat smaller sites to make the email address the primary key on the account too, and then it's virtually impossible

It seems to be a common antipattern for somewhat smaller sites to make the email address the primary key on the account too, and then it's virtually impossible to ever change it after that. As you scale up it becomes impossible to ignore the fact that people change email addresses sometimes, but I've lost track of the number of smaller sites that assume it's a safe primary key.