How about changing the email address can only be made if you put the current password too? Because with the current structure, if someone left their account logged in, then somebody else use that account, they can just change the email address, then use the Forgot Password function, then change the password. You know that moderators can change other members email, right? Honestly we can hack their account and they can not access their account anymore without the Ban function. Haha. Though i wont do that. But if others might have problems with other members, they can block them out. Lol. But im not so sure with this. I havent tried it.