Yes! That’s why we are couting it as an issue at the first place. Since you are able to access edit profile page for any user, pre-filled data was there.

Secondly, Yes, there was no auth/verification on the email change.