- under xoops general setting I've set user to be unable to change the profile email,
but using the profile module user is allowed to change it anyway
Are you sure about that? I think this is because you are logged in as admin. Users in the webmasters group can change email even if you have set it to 'no' in the User Info Settings.
(..modules/system/admin.php?fct=preferences&op=show&confcat_id=2)