Frankly, it sucks. I know for full RFC validation, it's quite complex, and maybe overkill, but what we have now is too simplified:

In T150337#2783166, @Etonkovidova wrote:

Just checked how the email address change is handled now:
(1) An email is sent to the old email address to inform a user about changes in the email address.
(2) When a user adds email address in Special:ChangeEmail, the validation for the email address is checks for limited number of options:
e.g. typing 11111 and clicking 'Change email'
Please include '@'in the email address. [user email] is missing an '@'.

But 11@111 or '2345'@1 are considered valid email addresses.

It might be worth to improve the validation of email addresses https://tools.ietf.org/html/rfc1035#section-2.3.1 and https://tools.ietf.org/html/rfc5322#section-3.4.