What is the best practice to change Email Address
Here is what we usually do :


either let people change their information by logging in the system, either after sending an email with a checksum link to let them update their own information. You can use a webform but in that case, you don't have to worry about the matching rule (i.e. you match with the user logged in or the checksum)
for anonymous form, i prefer to use Email + First Name as a matching rule as it is quite unlikely in most case that people with the same email will have the same first name.
the synchronisation between Drupal user email and CiviCRM contact email is not automatic and you will have to set some process to synchronize the 2. You might want to bloc edition of Drupal email and add a Drupal Rule to push master CiviCRM email into drupal account. I usually have my own custom code for such a thing.