I'm building a website where you can register with an email account.
In your account private section you can find a form where you can change the email address to use when logging in. I wanted this form to send an email to the previous address in the form of "You can no longer use this email address to log in here at blahblah.com, you have to use newaccount@mail.com."
Can I tell to the previous email the new email address, or am I creating a vulnerability?
Not at all. The account and both emails belong to the same person, right? So you are notifying the same user that he changed his email, so you are not publishing anything to a third party.
And just in the case that indeed the email change is being performed a third party that got access to the account in an unauthorized way, you better send that email out noting that they are changing the email account associated with your website, and if that was not by them, to take proper action (usually the user is asked click a link to cancel the email change, or directed to contact a support email address).
This is typical behaviour for many sites. It informs the user if there has been unauthorised changes to the account. The same goes for physical addresses, phone numbers, passwords. The email on the account is sent a notification.
If someone has unauthorised access to the account to be able to make a change, then that person already has all the info they need, so sending an email should not be a problem.
