In the event of 10 codes being stole by burglar, or email hacked (while hacker chooses not to let it know), and account breached, email notifications might be the last notification option something is amiss. I changed my email adress and I got no email to my old email. (I understand that sometimes old adresses become invalid, but we do not need to reply or click on a link anyway. It might be the last hint something was taken over.) Maybe give us an option in our account 'Would you like to get informed if login stuff is changed to old adres always?' Maybe include a countdown on 'cannot be negated' +email notification on emailchange attempt so a hacker cannot bypass it. (Yes, a emailhacker can delete emails. But this also can be countered with multiple options)