What do requirements tell? This is the only authoritative source in this case, so refer to the requirements.
If you are asking the question because you're actually drafting the requirements themselves, then take in account that:
Persons change e-mail addresses occasionally. Either because they change the provider, or because their old address receives too much spam, or because they don't like their old e-mail address any longer. Whatever. Preventing a person from changing the e-mail on your website would eventually result in this person not being able to use the site any longer.
Switching the e-mail address originally used for registration isn't a mundane task. For x valid uses of this task, you'll have y piracy attempts (an attacker gained access to the account of the person and switches to the attacker's e-mail address). It's up to you to protect your users against those attacks.
This is much more difficult than it looks like. One of the problems is that a legitimate person who needs to change her e-mail address on your website may sometimes not have access to the original e-mail account, so sending an e-mail with a validation link is not an option here.
Doing this the old way—asking the person to send you a letter or call support—may be easier to implement. However, one should ask himself how an identify of a person can be confirmed through a phone call.
When the e-mail is changed, you may legally be required to keep the previous e-mail addresses.
The idea is to authorize the user via an Email/PW combination.
What about two-factor authentication?
Seriously, ask yourself if you really, really need to do your own OpenID provider from scratch. If you have 10k reputation on InformationSecurity.SE and you have a professional experience in authentication/registration systems, please, do. Otherwise, you are putting your users and your company at risk of piracy.