"Verify with password" field when changing your username is not taken into account.

If you're already logged in through minecraft.net, and you change your username. The "Verify with password" field isn't checked, meaning you can submit text that is not your password and the request will still go through just fine.