That's not true. I just tested it a second ago and you do receive a verification mail if you try to change it to a new one. In addition, if you try to log in from a computer you have not used before you are also required to use a verification link before you're able to log in. Why they don't work for you I don't know, but I just tested both systems myself and they work for my account. Maybe your hacker has access to your email account as well and deleted the verification links after using them.