Honestly, I would say that my account wasn't secure, and it's not like I am blaming it on the administrators.
Well, your subject line says otherwise.
My point is, why don't they at least allow user to confirm that they are changing the email; you need to understand that change an email is unlike changing the password; changing an email is more like changing account ownership so you cannot do that without confirmations.
There are instances in which even the email addresses are being compromised by these hackers.
Also, maybe that change of email and change of password do cross line is some instances. Given that an email address is comprised, every relevant information (ie. accounts) are at risk and next to it is the changing of passwords. So that the original user will totally lose access to his/her account.