[jrochkind1]

If their policy is that support staff should never be able to change an accounts email address... why does the system let them do it?

[IgorPartola]

At some point someone has direct DB access and can do this. Sure, normal support people don't but this just makes the social engineering aspect a bit more complex, not impossible.