m4v3rick the email on the user account will only change after the user confirms the new email. Until this is done, the user will continue to receive notifications to their old email and the old email must be used for login (when not using username).
A user can actually ask for as many email changes as they want, they will receive an email for each, but only when they click one of the links will anything happen to their account.
This is what should be happening. Is it not the case?