Allow user to change email address before verification

[zh99998]

1. “email bomb attack” thing could make by normal register too. if there is access rate limit for register, just do same thing for confirmation email resent.

2. event inactive user has identity. they try login using username or previous email, and a password. they can be used for auth.

3. my users is imported, which is not require confirmation before, lots of users inputed wrong email address. let every of them contact admin is impossible.