I'll test it.
Change my email twice and see if the first email can lock it still.

This way the original account holder lose the activation/confirmation code 

I think still hacker can lock the account as s/he has received email but Not sure.