I’m curious. On my test Discourse instance, I can definitely change all of the fields on my test profile: name, username, and email. This is with trust level zero.
Do you have a setting changed that prohibits this? For example, you can change “username change period” to deny username changes.
Edit: I suppose your point here could be that if you disable username changes, then it certainly would prevent people from changing their username, yet the email would imply they can. Similarly, if you disable the “real name” feature, the email may not change to reflect that either. People can definitely change their email addresses, though.
Edit 2: For further validation, I made sure that I was up to date. It’s working correctly on ee449b0dd5be9a85eed598cddedcc9875de2214a.