Tell me if I'm wrong.
You are right.
The link which is sent to to the orginal email address when the email address is changed locks the account as as you said account being locked is different from getting banned.
It's not yet queued.
Do you have any useful links about it?
If so - please let me know.
Once the account recovery is queued, it's reported on
security log and it's also recorded on
BPIP.