Bypassing creation of API tokens without email verification

Summary

Cloudflare restricts the creation of API Tokens to email-verified accounts, however, if an email-verified account changed their account's email address without verifying the new email, previously created API tokens remained valid and could be rotated in the Dashboard. Cloudflare's Engineering Team changed the process for changing an account's email and required verification before the completion of the email change procedure.