Email change should require confirmation

[peter-]

When registering an account one is initially prompted for an email address which is then verified by sending a URL with a token there. But once that email address has been confirmed and registration has been completed (by entering a name and assigning a password) the registered account data can be changed again at any time, including the email address. Only this time no confirmation email is sent, instead the data is updated immediately. That's fine for name changes, but I think is less than ideal to allow for the email address field:

Unless email is being set read_only=>true in the formFields array, which completely disables any email address changes (the workaround I've been using), this allows to set an email address the subject cannot actually receive email at, most likely because of a typo, which will prevent resetting the password via email in the future, potentially causing increased support calls.