important E-Mail Input Field bypassed allowing Account Lockout and Takeover

Dear Ladies and Gentlemen,
First of all, thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Josef Hassan ([email protected] ) and I were able to Account Lockout Vulnerability by bypassing the Input of the E-Mail Address.
The Process of identifying the Vulnerability

1. Login
2. Go to https://roy.demo.phpmyfaq.de/admin/?action=user&user_id=1
3. Anybody can change the User E-Mail and it is required to type an E-Mail
4. If there is no E-Mail the User can maybe lock his account and never get a Passwort Reset E-Mail because no E-Mail Address is written in the Field
5. We were able to bypass the Security Mechanism and do not need to type an E-Mail Address which can lead to an Account Lockout without any Possibility for Recovery

Thank you very much for your time and effort and hope hearing from you soon.

Best regards
Ahmed Hassan & Josef Hassan