Currently, anyone with access to either of the user admin pages (/acs-admin/users or /dotlrn/admin/users) can change a user's e-mail address (I know you are talking about a new username field, but I think they are functionally equivalent here).
It seems to me that this would be a minimum level of desired functionality; people do sometimes regret the cutsie username they picked before they cared about their standing in the community. :) And of course e-mail addresses do change as well. It would be better if users could do this themselves, but I think it's important that admins are able to do it.
I haven't given any thought to authentication issues so I won't comment on that aspect.
