Yes please add this feature. Having email verification for every transaction would make things MUCH more secure, and I would have avoided this.
If someone has access to the account, it is easy to change the e-mail address.
E-mail verification would not have prevented this, though it might leave a pointer to the perpetrator if they were really stupid.
A hacked gmail account could be used for the e-mail verification.
Perhaps a better solution would be to lock any transfers out for 24 hours after an e-mail change and to send notice of the e-mail change to the new and old e-mail addresses.
That might have stopped this, but it will also annoy some users.
