check if the new address is not already used

lib/models/subscriptions.js

@@ -1167,25 +1167,42 @@ module.exports.updateAddress = (list, cid, updates, optInIp, callback) => {
             let query = 'SELECT `id`, `email` FROM `subscription__' + list.id + '` WHERE `cid`=? LIMIT 1';
             let args = [cid];
             connection.query(query, args, (err, rows) => {
-                connection.release();
                 if (err) {
+                    connection.release();
                     return callback(err);
                 }
                 if (!rows || !rows.length) {
+                    connection.release();
                     return callback(new Error('Unknown subscription ID'));
                 }
 
                 if (rows[0].email === emailNew) {
+                    connection.release();
                     return callback(new Error('Nothing seems to be changed'));
                 }
 
+                let old = rows[0];
+
+                let query = 'SELECT `id` FROM `subscription__' + list.id + '` WHERE `email`=? AND `cid`<>? LIMIT 1';
+                let args = [emailNew, cid];
+                connection.query(query, args, (err, rows) => {
+                    connection.release();
+                    if (err) {
+                        return callback(err);
+                    }
+
+                    if (rows && rows[0] && rows[0].id) {
+                        return callback(new Error('This address is already registered by someone else'));
+                    }
+
                     module.exports.addConfirmation(list, emailNew, optInIp, {
                         action: 'update',
                         cid,
-                    subscriber: rows[0].id,
+                        subscriber: old.id,
-                    emailOld: rows[0].email
+                        emailOld: old.email
                     }, callback);
                 });
             });
         });
+    });
 };