recoverEmail - mail is sent to the wrong email address when changing it two times

### [REQUIRED] Describe your environment

* Operating System version: Windows 10
* Browser version: Chrome 87.0.4280.88
* Firebase SDK version: 8.1.2
* Firebase Product: auth

### [REQUIRED] Describe the problem

#### Steps to reproduce:

I tested my email action handlers and noticed that if you change your authentication email two times, the `recoverEmail` notification is sent to the wrong email addres.

Reproduce:
1. Change email1 to email2
2. Verify email2 with `verifyEmail` notification - email1 receives `recoverEmail` notification as expected
3. Change email2 to email3 - **email1** receives `recoverEmail` notification again

I´m not sure if this is intentional, but in my opinion, since email2 was already validated and verified by Firebase, email2 should be handled as the new primary email address.

#### Relevant Code:

```javascript
firebase.auth().updateEmail(newEmail);
```