Here is something I think is a little know fact. If you have the record locator and the passengers last name, you can pretty much do what ever you want with the ticket. You don't have to be signed onto the site to effect changes, such as Seat Changes, Cancel, Change Flights, etc.. I accidentally learned this about 20 years ago, when I manipulated my own ticket on US Air without signing on first. I've confirmed that you seem to have full access to the ticket on United too.
Getting both pieces of information may be difficult, but once you have them, it seems like there is no protection in place.