SECURITY: rate limit change email requests