In Nagios XI up to and including 5.8.5, it is possible for a user without password verification to change his e-mail address.
nagios nagios xi