通过 API 更改用户电子邮件地址而无需确认

I would say this is a self inflicted wound at that point?