The really shocking thing is the lack of any delay with email changes. I've known several people whose accounts were hacked and properly flagged by Facebook within hours but the hacker was able to change the email address immediately with no waiting period and remove the other addresses so access was impossible.

I tried this on my own account shortly after and, sure enough, there's no waiting period where previous emails remain allowed to reset passwords.