That makes sense to not be a default setting for everyone, can be annoying if regular user lost access to previous e-mail then needs to open help-ticket to get that corrected.
The other slightly less secure system is to just have a notification e-mail with a notice that says “If you made this change, no action is required, but if you don’t recognize this action click link to report unauthorized access.” Not sure if that is a feature integrated with discourse or can probably be done with a plugin or something.