[Admin]

I still can't recreate this bug on my unhacked local board.

Looking at the code this shouldn't happen:

  if ($verifyemail and $email!=$bbuserinfo['email'] and $bbuserinfo['usergroupid']==2 or $bbuserinfo['usergroupid']==3) {
    $newemailaddress=1;

[high]    // delete old activation id
    $DB_site->query("DELETE FROM useractivation WHERE userid='$bbuserinfo[userid]' AND type=0");[/high]

		// make random number
		mt_srand ((double) microtime() * 1000000);
    $activateid=mt_rand(0,100000000);

    //save to DB
		$DB_site->query("INSERT INTO useractivation VALUES (NULL,'$bbuserinfo[userid]','".time()."','$activateid',0)");

    $username=unhtmlspecialchars($bbuserinfo['username']);
    $userid=$bbuserinfo['userid'];

    eval("\$message = \"".gettemplate("email_activateaccount_change",1,0)."\";");
    eval("\$subject = \"".gettemplate("emailsubject_activateaccount_change",1,0)."\";");

    mail ($email,$subject,$message,"From: \"$bbtitle Mailer\" <$webmasteremail>");

    $bbuserinfo['usergroupid'] = 3;
  } else {
    $newemailaddress=0;
  }

See, it deletes the activation ID whenever you change your email address.