> ... letting an user deny the password change with the old password is pretty horrible in case the password was leaked. That's a different threat: an attacker

> ... letting an user deny the password change with the old password is pretty horrible in case the password was leaked. That's a different threat: an attacker knowing your password. Well... How do websites that allow instant credentials resets by email typically deal with a password reset asked by someone who knows the current password? Instant change too ("enter your current password / enter your new password twice"). And the good guy is locked out of his own account. I don't see how it's worse than that.