Discovered by accident, steps to reproduce
- create account, use email address (A)
- receive verification email, do not click yet
- in portal, change your email address
- click the verification link in the email
This flow will verify email for user, even though current email differs and verification code was not delivered to email being marked as verified