I am a new discourse user and I ran into the same issue. When I try the same approach (deactivate the user, update the email address, and then activate the user) it sending an email to confirm and it is only updating the email address after clicking the confirm email link. Is there a way to avoid this? I am using the API to do all the three actions.