Welcome aboard and thank you for this feedback
You’re definitively right, we should improve this process.
Sending a confirmation email may also have some downside. Sometime, people update the email address associated with their Cozy because they have loose access to the previous email account, or it has been hacked.
So sending a confirmation message to the old address is not a silver bullet.
And sending the confirmation message to the new address does not protect you if someone get access to your Cozy and update the contact address to prevent you from login in.
We will think of this and try to find a way to improve the process.