Originally Posted by WineCountryUA

Not sure what you mean by "allowed" -- you can do it and there is essentially no way to trace who did it(except by IP address which is not useful in many cases)
Such as Unauthorized flight reservation change made by someone else

This issue has been discussed many times and it is a needed feature for those that have others manage their travel. But it can be misused -- hence treat your PNR / BP with respect
And yes the scammers use this feature.