It is possible to access the change password form by going directly the page containing the service.

This service should be protected: if there is no token, it should be proposed to the user to enter its email (as it is done for "I forgot my password")