A couple of minutes ago I discovered this by accident. So in short, I can log in on very Stack Exchange site with an e-mail id which is no longer associated with this account. The current e-mail address that is set works fine too of course.
Ah, I think I know what's going on...
You get one "contact" email, which you can change here: https://meta.stackexchange.com/users/email/settings/current - but you can have unlimited login emails, which you can view (and change) here: https://meta.stackexchange.com/users/mylogins/current - you've changed the former, but the latter remain.
These are slightly linked, in that if you have a verified contact email you can create a credential for it at any time simply by resetting your password - so it will in effect act as a credential by itself. This is mostly a convenience, a way to help folks avoid getting locked out of their accounts: generally you would not want a contact email that isn't also a credential. However, some folks do, and the system does allow it.