If they didn't take your password then anyone could e-mail in saying "Hi liek my account needs it's e-mail changed the account is Stefan and it needs to be changed from
[email protected] to
[email protected]".
Oh wait, of course. If people post beforehand on the message board, then that's proof that it's legitimate. But it isn't this account that needs it's e-mail changed... it's another one, with which I can't access the forums (because the name is too long or something).