Our website uses a system where the username is the user's email address. We have a function which permits the user to change his email.
What is the best way to go about this?
- Send an email only to the new email address just to confirm the change.
- Send an email to both the new and the old email addresses for confirmation.
- Send an email to the new address, asking the user to click a button for activation.
- I'm open to any different suggestions as well.
I'm concerned about functionality, security and usability. There could be some problems with activation; for example, activating an email address that has been created between the change request and the changed email activation would certainly cause some problems. I'm probably forgetting other corner cases...