This email issue and 2FA security sittings have been discuss numerous times and he's an official statement from theymos on the issue.
From what I understand view this quote below although I haven't been hacked before so don't know how effective it's
I added email notifications for some security events:
Whenever your password is changed (except by an administrator), you will get an email about it.
Whenever your email is changed (except by an administrator), your old email will get an email about it with a link to lock your account. The link is valid for 14 days.
Let me know if you find any bugs.
Then few hours later this user confirmed the system is working just fine.
Whenever your password is changed (except by an administrator), you will get an email about it.
Verified , no problem, email received if password is changed.
+logout
+login to test changed password
= no problem.
+forgot password link
+email received to reset password
+change password
= no problem.