Allow users to edit user account email from front end form in Craft 3?
UsersController::actionStartElevatedSession() is public so you can access it via frontend form but you should only call it via ajax request.

You can just submit your normal user form via ajax and if it contains an error with key currentPassword you can be sure to require a elevated session and display a password form to enter it in order to create a request to the route above. This will start the session and you can submit the user form a second time. 

So in summary: you don't need a custom controller at all. You can change the user's email and password by submitting a form with newPassword and email but you'll receive the error Incorrect current password if there is no elevated session or if the password parameter doesn't match the user's old password (you always need to submit it together). 

If you want additional security you can send the sendVerificationEmail to force users to verify their email by sending them a mail. But keep in mind all those things can be manipulated via frontend request. Users are totally free to change the html of your form