I would require them to login first before they can make any account changes. This is for security reasons...I don't want to give an un-authenticated user too many rights to make changes in an app.
As for changing a password, I make them type the current password, and confirm the new one. I require them to confirm it so they don't mistype the password, if the passwords are equal, then I update it, if they aren't I throw an error back to the user.
To make other account changes (name, address) I still require them to type their current password. This is for security purposes. True they are probably already authenticated, but if someone hijacked their session, maybe they forgot to logout on a public computer, that person wouldn't be able to change their password and email.
If they forget their password, I let them enter username or email and they get sent a password reset link, which emails them a new temporary password. The reason for this is that they have to have access to the user's email to reset the password.