This is not correct. Or at least, it should not be AFAIK. I actually just tried it on an account I own, and it does not send the email to both addresses, only

This is not correct. Or at least, it should not be AFAIK. I actually just tried it on an account I own, and it does not send the email to both addresses, only to the recovery email address. If that is really happening to you, that sounds like a bug to me.