CiviCRM does not correctly use drupal's hook_user

As noted above the function:

• Note that we ignore the edit field and do not follow the drupal protocol
• of extracting values from the edit field. We extract the fields directly
• from $_POST. This is because the underlying form package that we use
• (HTML_QuickForm) does the form value extraction and validation.

However this incorrectly assumes that the use object is only modified via the user account form. Several modules modify the user object directly via user_save. CiviCRM's implementation of hook_user does not follow the rules for the $edit argument, and thus does not update the email address when altered programatically (without the account form).