Today I logged in to Steem and chose "Reset Password" option.
Everything looked ok, but...
But I saw that name of account, that will have password reset, is set by word after "@"
So I changed it to "ned" and got something like this:
It clearly shows that it is my account (satch) and there is password change option of certain user named "ned". In this way you can change password of virtually every single person on Steemit (of course if you know their passwords), being logged in your account during that process :)
Honestly, I would like to know the answer - is it bug or feature? I think there are many people capable of giving a full and detailed answer.