At a minimum, a good system would email both old and new email addresses saying, "someone has changed the email address, click here if that is wrong". This kind of slapdash approach to security needs to become criminal because companies are clearly not following best-practices and to be honest, as someone who has implemented these sorts of things on a number of legacy systems, it really isn't hard to do.