Typically two confirmation emails should be sent:
One email should be sent to your old email address ("You asked us to change your email address") which would allow you to revert the change if it wasn't you that did it, or you changed your mind, or you made a typo.
One email should be sent to the new email address asking you to authenticate with your password.
The account change should not happen until the authentication has happened with the new email and the password. Until then, the old email address is still registered on the account.
On your site it would be advisable to put a banner e.g. 'A confirmation email has been sent to firstname.lastname@example.org (change this)' so that users can see the new address clearly, and let the user correct the new email address in the event a typo has been made. If the new email address is updated to something new again, then authentication via the incorrect intermediate address should not be allowed. The banner would remain until the authentication has been made from the new email or reverted via the old email, or cancelled on the site.
[Disclaimer: I'm not a security expert!]