Change the account email

Two steps if the current address is verified, one if it is not, and that asymmetry is the design. Moving an account's email is how a stolen session becomes a stolen account, so a verified address has to approve before the new one is even offered a link. An address that was never verified has no established owner to ask — demanding proof from it would only block the person it is meant to protect, which is exactly the person who mistyped it or let an agent invent it.

This is the account email: who we bill and notify. It is not what carriers see — that is brand.contact_email and agent.contact_email, and Google emails the latter a mandatory authorisation request during launch review.