Before I go and change things, I'd like to bounce this off some people.

Most sites work just like Zen does. You want to change your password, so you log into your account (obviously requiring your password) and you click on Change Password and now you're required to enter your current password... again.

First off, I hate unnecessary repetition. But more to the point, I want to help customers who have their accounts auto-created during a PayPal Express checkout. If they click "My Account" and go to change their password... what is their "current password"? They have no idea since they were never given one.

So I'm proposing that I'll simply remove the current password check. But am I opening up a security risk? I don't think so, but perhaps I'm missing something.

I want to preface by saying: ignore the whole "perhaps they walked away from their computer and someone could hijack their account" scenario. Other than that scenario, what is the harm of allowing a more direct password change?