For US accounts, PayPal requires a person to verify the security question on the account if one was set or the credit/debit card number before being able to change the password.