On the modify profile page, you require my current password to change my e-mail. Cool, I like that.

On the e-mail validation page, you don't require my password to send the activation key to a new e-mail. While I can't fully test this since my e-mail is considered invalid, this is an inconsistency that might need to be patched?

That, or if it considers my login good enough proof on the validate page, then why isn't the modify profile page updated to check for current pass OR login? For the sake of consistency.

For sake of security, I have changed the e-mail validation page so that it is only accessible if you've not already validated your e-mail address. Will look at other options of removing the e-mail field/forcing it to require the current password in the future.