This might not be a bug, but it ís a security issue. If any user forgets to log
out, and somebody else comes acros the chage settings page, he or she could
easily enter a new password and mail address, thereby completely hijacking the
account.

I think it's important to ask users to enter their password to change those
settings, even if they're logged in.