it's possible change a password without owning the account.

[tomivm]

it's possible to change the password of any account only with post an email on user/forgot and using the id of the user on user/store-password

Not only that, when post to /user/forgot endpoint is sending the private token in the response.