Thanks for the suggestions. I gave them a try in the following way:
1. Add secondary email to user via api
The email is unconfirmed, but tied to the account
2. Configure the following settings:
- I forgot to set the saml sync to true, however I don’t think that would have affected the outcome. The issue still seems to be conflict in terms of the email confirmation.
3. Result
The result was the a new user account was created based on the new company email. Worst case I could merge these, but that is a really nasty worst case.
I can still see the unconfirmed email in the old account. I try to resend the confirmation just to see what would happen but I get a 403 error(Forbidden).
It looks like the email needs to be confirmed first before we can syncronise them 
Unless there’s something I’m missing, it looks like I need a way to confirm the second email.
I wonder if this still has the same issue in terms of confirmation, or are they assumed to be confirmed? An additional complexity is that the user part of user@company.com has also changed. But I suspect that would mean we run through a csv of mappings between the old and new emails.