https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Authentication.md#v21-password-security-requirements requirements numbered 2.2.3 and 2.5.5

recommends that changes to email addresses or password credentials result in
notification to the user. They prefer a push system, but notification
to email address can work.

To implement, a reactor that monitors primary email or password change and emails
user at:

   old and new primary email address about email address changes
   current primary email address for password change

Some text similar to:

  Your <(email|password) has changed on the xyz tracker. If you authorized this
  change you do not need to do anything. If this change is unauthorized,
  please notify the admin at .....

should be sent.