changing the user's password

[jimfog]

I suppose that if a user wants to change his password. it is always best practice to ask for old one, check with the db that indeed he has provided the old one and send a confirmation e-mail in order to finish the process. Is there something else to know about the change password procedure?

[Mudsaf]

I'd rather do it without old password. I would do it like how most "forgot password" methods worked. Also if user is logged in it would require no confirmation or security question confirmation.