An attacker can change registered email addresses of other users and take over arbitrary accounts.
CWE-639