When someone tries to update email in their profile, it doesn't send a verification link to the new email address for verification. So, anybody can set any email address for their account.
The vital risk here is that if someone enters the wrong email they'll no longer receive email notification and password reset won't be possible.
When someone tries to update email in their profile, it doesn't send a verification link to the new email address for verification. So, anybody can set any email address for their account. The vital risk here is that if someone enters the wrong email they'll no longer receive email notification and password reset won't be possible.