How do other admins deal with compromised accounts?

[Moin]

@Architect

If the notification e-mail can include an authentication link that won’t complete the deletion of old e-mail unless link is clicked, that may help unless their e-mail accounts are also compromised.

That’s possible. It already works that way for staff accounts but there is a setting to enable that for everyone. But it also means users who lose access to their email address can no longer change it on their own