SECURITY: rate-limit and prevent blocked users from changing email