[ptero]

Yes, you often only need the 6-char conf code and last name to change or cancel a random reservation.

The system is not set for security only for convenience and assumes a world of 80-90s of regulated travel with never full planes and no change penalties. At the time (US) airlines were even honoring competitor tickets at gate (assuming they has space, which they almost always did) -- show up with AA ticked at a United gate and get it swapped for a United flight by agent on the spot. Gratis.

The system had lots of problems, but malicious changes were not one of them.