It would be very practical if you needed not only the password but also the MFA to change the email address. This gives you even more security that an account cannot be taken over by strangers.
·