As designed Users can get out of bounced state just by not changing their email

[MilkyMeda]

Affected version

2.2.3 Patch 1

src/XF/Service/User/EmailChange.php:92 moves user to valid state without checking if the email address has been changed.

 

[Mike]

This is as designed. There are many reasons why an email may be valid but have temporary issues that put it into a bounce state (often including issues with the server sending the email itself). Forcing users to change the email to attempt to reconfirm was a very common complaint. We will now trigger this process without the email being changed if they save the form.

The code you point to is only applicable if there's no need to confirm the email address, which in the vast majority of cases means that email confirmation is disabled, which really isn't something we'd recommend for an "average" install (where anyone can register). Additionally, in this situation (no email confirmation), they could simply change the email address to something else and then immediately revert it and it would result in the same state.