How to change user email? Recipe: EmailPassword (later I'll move to ThirdPartyEmail recipe, so just want to learn the fundamentals here)

There is a function for that in the email password recipe

This covers authentication itself or is it the responsibility of the backend to verify session and match current email first and then call this method?

Well. You should call this from an API that does session verification

Thank you