I have a website where users login with their email address and password. They also can update their account details like first and last name, location and their email address. In the case they make a typo during updating their email, what's the best way to let them recover their account?
Typically two confirmation emails should be sent:
One email should be sent to your old email address ("You asked us to change your email address") which would allow you to revert the change if it wasn't you that did it, or you changed your mind, or you made a typo.
One email should be sent to the new email address asking you to authenticate with your password.
The account change should not happen until the authentication has happened with the new email and the password. Until then, the old email address is still registered on the account.
On your site it would be advisable to put a banner e.g. 'A confirmation email has been sent to email@example.com (change this)' so that users can see the new address clearly, and let the user correct the new email address in the event a typo has been made. If the new email address is updated to something new again, then authentication via the incorrect intermediate address should not be allowed. The banner would remain until the authentication has been made from the new email or reverted via the old email, or cancelled on the site.
[Disclaimer: I'm not a security expert!]