I tried to login to booking.com, but it claimed that I hadn't registered yet. So I registered again, with the same email. It didn't verify my email, and after login out and in again, with the new password, all my old bookings were still available. So yeah... I was effectively able to change the password without any form of verification.
This was 20 days ago.