Is it legal to redefine wp_password_change_notification in a mu plugin?

Here are the contents of a working example, placed in a php file in wp-includes/mu-plugins/. The email is sent when a user completes the password reset action after clicking the reset link in the email they receive.

<?php
if( ! function_exists( 'wp_password_change_notification' ) ){
    function wp_password_change_notification( &$user ){
        wp_mail( get_option('admin_email'), 'Test', 'test' );
    }
}