Should users be allowed to to login with the same email when an email change is requested but not completed?

Question

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an email change can only be done when someone is logged in, whereas a password change (through the "forgot password" flow) can be done even when someone is logged out. It'd therefore be impossible to lock someone else out of their account if a login was not allowed while the new email hasn't been verified yet.

With that in mind, during the period between the email change request and the new email being verified, should log in with the old email be permitted (assuming that the email represents the username)?

Answer 1

Verifying the email upon change is more of a UX protection than a security protection. If a user has a typo when they enter the new email, and don't notice it, then they will end up permanently locked out of their account unless they can login with the old email. As a result, it's actually the opposite:

A user MUST be able to login with their old email until the new one is verified.

A user SHOULD NOT be able to login with their new email until verified (this will just cause confusion and the user will skip the verification process)

One quick note on why this isn't really a security measure: an attacker can easily provide and validate an email address, so this doesn't provide any protection against account theft.