We have a dashboard that our users log into using their email and password. We don't currently have the ability to allow them to change their own email address (login).
Sometimes, a user may contact us via email to have their emails changed which will then, of course, change their login.
What is the proper way of handling this?
Send the user an email to their OLD email address to notifying them of this change and asking them to confirm this change
Send the user an email to their NEW email address once the user has confirmed (1)
What about their passwords? Will they need to input it in (1)?