Change in password and email address should follow the confirmation email sent to address used during sign up.
But many users use fake non existing email during sign up so first we have to make sign up confirmation also
You don't have to describe the standard way of how this could/should be working. It is what it is right now, and I doubt that we are going to see changes before the switch to the new forum. I don't see the current method being a problem as long as there is at least 1 active admin that can respond to those requests in a reasonable amount of time. But many users use fake non existing email during sign up so first we have to make sign up confirmation also
