[anthonyb]

What are the odds that there's a similar bug which allows changes to user accounts? If that's the case, then altering the password or email address is trivial.