Just to clarify, the problem is not that I cannot change my new password. The password is emailed to the user. This proves it is the user's real email address. If it is on the web page, anyone can set up a new account with someone else's email address, because they get the password from the website.
As far as I know the password is only on the website in the behind the scenes area that is only seen by you. There are no passwords or email addresses visible to a visitor. They are are visiible to you when you are logged in and if you forget it and they email you a new one then you just change it. That is what happens in most websites accounts.
You can log out and look at your page to see what a visitor sees.
it works like that on all sites. it goes to the original email, not one you make up. and unless your in that other person's account you wouldn't see that password. and if someone sets up a new account with my email, i will get news about that account - they won't. but all sites are set up this way, it only goes to the registered account, and i think all email addresses have to be unique because of that.