Users can change their emails if:

• in Security settings email is selected as editable profile field
• user has a role with permission allowing to change their profile details (under Actions)
• user belongs to only one workspace (if they belong to two or more workspaces, they can't change their email)

I found out about the last point accidentally today and it's unclear why I couldn't change an email despite meeting 2 first requirements

In short, there should be a popup appearing after hover over the pen icon informing user that they can't change their email because user belongs to 2 or more workspaces.