If a user changes their email it would be good to have a confirmation email sent to the old and new email - in case they are not the person who made the change.

Also when someone updates their username an email confirmation should be sent to the email on the account - in case it's not the real user and they are subsequently locked out of their account.