If I try to change a user's password, I run code like the below:
$api->user->changePassword(array(
"new_password" => $new_password,
"current_password" => $current_password,
"user_id" => $user_id
However, if the value for $current_password is incorrect, the password is still changed.