Modifier l'adresse e-mail de l'utilisateur via l'API sans confirmation

I would say this is a self inflicted wound at that point?