Is there a point in sending a confirmation mail to the old address? I see two points there
- If your account is taken over, a confirmation mail to the old address with an undo link would revert the take over.
- If your e-mail address is taken over, you cannot change the mail address on the service as the attacker can cancel the request.
The first point would be a big benefit for the security on the service. The problem is, that the second point makes the life for someone with a hacked e-mail account even harder.