Should the user be given the right to change mail?

Question

Information Security

The site has only classic registration and entry through VK (there are no telephones, sms, etc.).
Question: does it make sense to give users the right to change their email address, for example, if they log in through VK and enter the left mail just to get behind them. Wouldn't this lead to a security hole for legitimate users? And how to change the mail if the user does not have access to the old one?

Answer 1

Question: does it make sense to give users the right to change their email address, for example, if they log in through VK and enter the left mail just to get behind them. Wouldn't this lead to a security hole for legitimate users?

Giving the right is worth it, but through support and ONLY ONCE! It is also worth informing the user about this in advance.
This task depends on the type of activity of the company. For example, I have more than 7 personal email addresses + corporate email addresses.
No, not right. To change mail, you need to develop an additional "layer" of security. For example, the user must enter one of the old passwords (store a hash table), or answer a few questions. Or a secret phrase, a word...