Ask HN: Is it okay that email change doesn't require my password?

On HN, changing my password requires me to type in my existing password. This makes sense: it prevents someone with my session from stealing my account.

However, there doesn't seem to be anything preventing someone from changing my email and submitting a password change request. It seems like a lot of websites allow this.