We have a user who has mis-typed their email address and forgot their password. How can we intervene and update their email?

You should be able to update the traits via the admin API: https://www.ory.sh/docs/reference/api#tag/identity/operation/updateIdentity