connectedblue thanks for the report, that's definitely an oversight.
I have started work on a feature to request a one-time password directly from the change email modal. But I'll need a few more days to complete it.
In the meantime the only solutions are indeed to set a password on the user account, or alternatively to open a separate browser or incognito window, select passwordless login, then copy the one-time password at the bottom of the login email and use that in the active Flarum session.
