The unfortunate thing is that something like a Tampermonkey script that was loaded in your browser could cause that kind of event, and capture your new password

The unfortunate thing is that something like a Tampermonkey script that was loaded in your browser could cause that kind of event, and capture your new password and transmit that to a third party, where the e-mail address and everything else could be changed. But tools like Greasemonkey and Tampermonkey are the good guys. They tell you when scripts are updated, etc.... Malware versions of comparable tools could operate entirely below the surface, without your ever knowing.