I tryed to add admin\user password check on header_php.php in includes/modules/pages/account_password, and it works fine, but with one bug:

If a customer (logged with normal mail and password) or an admin (logged with mail and master password) try to change account password, in old password field there is no longer a check, any word will be passed as "old password".