No Confirmation Email For Email Change

How it was found

https://forum.blockstack.org/u/username/preferences/email

Hello, it looks like there is a security flaw in this part. While changing email address from email1 to email2. A Confirmation email is sent to email2 not to email1 which is the main account. This can lead to account lost if someone has used a public computer to access his/her account and he/she is logged in.

Also, while changing email address password is not asked to the user.