Your authenticator is the proof, not your email — so a password can only be changed by whoever is holding the phone with the code on it.