Old password is not verified during password reset in administration interface.
vulners.com/securityvulns/securityvulns:doc:25342