Alterar o e-mail do usuário via API sem confirmação

I would say this is a self inflicted wound at that point?