It's true indeed, that password is never asked when changing seetings account. This could be done as an improvment, and we'll take a look at this.
You gave as the exemple of users sharing the computer : if one of these user has the access to "Users" Application, this fix will not prevent from changing users through this application. It is important that an admin can change passwords without knowing the former one.
I'll write another message here to notice you when it's done.
By the way, I take this opportunity to introduce myself as a new core member of the Novius OS team You'll see me answering more than I did from the past.
I propose to enter the password, when users change their information.
Novius OS Elche (and probably other version) allows users to change ther information, such as Email, Password. They can change them without entering the current password.If users share the computer, other people can change the password. Entering the password before setting a new password will solve the problem.
The image below is a Google's Password Change Form.