The issue if I remember correctly was that you could require the email to be verified. But while that verification was pending, it would already use the new ema

The issue if I remember correctly was that you could require the email to be verified. But while that verification was pending, it would already use the new email as the user’s asserted attribute.