Experian should be shut down by the Federal Trade Commission and the Consumer Financial Protection Bureau today. There's no reason after the breach to allow them to have even one more sloppy mistake.

The biggest mistake here was not having a link in the old email that says "CLICK HERE if you did NOT change your email" that would undo the email change and put some sort of lock or hold on the account.