Should we ask users to confirm an e-mail address when they change it?

Question

I have a service that requires an active e-mail address where users can receive notifications. Users can optionally receive notifications on multiple e-mail addresses by adding them.

1. Should I require a new e-mail address be confirmed before I activate it?
2. Should I require an e-mail address be confirmed before changing it?

I'm looking for best practices. I'm not dealing with any sensitive or billing information.

Answer 1

Yes. Doing so protects users who have had their site accounts compromised from having someone change the main e-mail address and completely lock the user out of his account.

This is good practice regardless of whether or not the account protects sensitive information because nobody wants to deal with being locked out of an account by an attacker.