You are correct that we need to verify a person's identity when they claim their PODs, but it won't matter if you changed your password because the new password will authenticate you on the Steem blockchain. We are also looking at doing email verification.