I am not referring to any specific site in this question . If a site allows users to change email after login can't a hacker by obtaining user password due to users negligence then change email and then change username and password to gain full access ?
Everything is dangerous, including breathing and eating. It's all a question of balancing the risks.
You are looking at a case where the username and password of an account got compromised. At this point the attacker has full access to the account. What you are now looking at is what recourse a legitimate user has. How can they reclaim access to their account?
Emails are historically used as a reasonable stop-gap. If you have access to an email account, you're probably the intended owner of the account. It is nice because it is automated. However, if push comes to shove, and you really need to get an account back, the last line of defense is always to contact the company and talk to a real live person.
On the other hand, the need to be able to update credentials is very important. Many of us nowdays keep an email account from cradle to grave, but it wasn't always that way. Many people still use an email address provided by their ISP. If you couldn't change the email address associated with an account, you would be forever bound to an ISP -- quite the conundrum if you were to move to a new state with different ISPs!
So the decision is that the rewards outweigh the risk. Maintaining a solution for all customers using a service, even as they have to update their contact information, proves more important than the risk of a hacker using this to steal an account away.