SMS is one option, but then you end up with the same problem - what they've changed a number...

The system will probably have to give a way for the user to change email address while the user still has access to the old email address.

This is something that wasn't mentioned in the article but should definitely be solved.