Mind you, your access to the first email you use to register must still be accessible, code will be sent into that mail first just to be sure the real owner is trying to change his or her mail account.
AFAIK, this is not correct. You only need the correct password to be able to change the email linked to the account.
A notification email would be sent to the initial email used to open the account, but that is not about a code to "confirm the change", it's a security measures with a link to lock the account, if there was a hack.