A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts