Seems like it's possible to fire EmailValidated event without email address

[robinharms]

To reproduce:

• Add a user without email
• Login as that user
• Change email

When clicking on the link in the email the event seems to fire.

[robinharms]

It basically needs validation on the schema level since a change of address and address is validated could occur at the same time.