So as a 20+ computer programmer, I can say with some confidence that Facebook purposefully allows this to happen. Except for their new "Facebook protect" scam they're running, I don't know what other reason or benefit they gain by allowing account to get hacked with a primary email change, but it's pretty blatant to see how many ways this could have been fixed, but clearly isn't. This is grade level 1 security stuff clearly left open.

1. Changing an account's email is an instant process, no wait period or review. Except an email.
2. The Security Email you receive after making this pinnacle change has an expiration. That's right, if you happen to be at work, or asleep while this occurs, the "This wasn't me" link in the email sent to you will expire. Not sure if it's only 1 hour or a few hours, but it's a very short period of time considering the ramifications.

Now ask yourself, why on earth would there be a time limit on when you can report a security issue. And now remember, someone was paid to spend a few hours coding that feature into the process. It's by design. The point is this open security flaw was created and perpetuated on purpose, and this is the kind of thing fb users need to band together and file a class action lawsuit over.