If you know the PNR and name on the account you could do some serious damage, including canceling someone's boarding pass at the last minute.
I think.
Never tried to use money from a canceled/changed flight (knowing PNR and name) without logging in first; don't know if that would work.