I notice that it's possible for a regisered user to change their email address and wonder if it should be a requirement that their account becomes suspended if they do this, until they have again verified that the address is valid.
Possibly something a plugin could do, but possibly worth having in the core.