Managed Service Account has "Everyone:Change password" ACE by default

Solution 1:

Take a look at the default security ACL on a normal user account. You'll notice that Everyone has Change Password on those as well. But everyone can't just go and change each others passwords.

Remember that Change Password and Reset Password are two different permissions. Changing a password is something the user does for itself and requires providing the current password as part of the process. Resetting a password is something done administratively by another user and doesn't require the current password.

Edit: Nope, I was wrong about the underlying reason. Microsoft Article KB242795 explains better the underlying reason for the permission.

From the article:

The Everyone group has Change Password permissions on all computer and user objects so that unauthenticated or "anonymous" users or computers are able to change their passwords when they expire without having to be authenticated first. If the anonymous user is denied the ability to change passwords, the user would be unable to change the password without logging on.