It’s a way of keeping track on the user’s behavior in regards to SIwA. But you’re right, you need to have a mechanism in place for this scenario. Maybe keep track of all the email changes for the user?