Changing email address required confirmation which was sent to your email address which was not displayed through the front-end. Same thing would happen now, however previously the script kiddies (I refuse to use "hacker") did not know your email addy and now they will - half the equation is gone and now they just have to figure out your email pwd.