He wasn't logged in, if he was logged into the account he could have done what he wanted no problems, the reps don't have your web password. Your chat/call in password is different, it's analogous to asking for your SSN to do an account change.