With the method "FormTask_ChangePasswordQuery" PasswordQuery and PasswordAnswer can be changed. If the logged in user has no permission to change these fields, this method should not be available.
This is a product defect (30287).
This will be fixed in a future release of the product. If you require this immediately corrected, please contact Support for a hotfix referencing the defect ID 30287.