Change user's email address via API without confirmation

I would say this is a self inflicted wound at that point?