Could you implement an email verification for changing the BTC payment address? So when trying to change the BTC payment address, an email is sent with a link to confirm the change. That way the payment address can't be changed without express consent. I've seen some pools handle this with 2 factor authentication (also a good idea), but I think the email verification method is much easier to implement while still increasing security.
Maybe in the future. I still believe that hacking certain either customers or providers account is nearly impossible - passwords are very long. If someone do get a hold of your password, then he either got it from your email (so your email was already compromised) or directly from your pc (from where you use email - again compromised). I see no additional security if I implement this.
What about just an email notification that the payment address was changed? I understand what you're saying and perhaps an email verification isn't a good way to implement this. My concern stems from experience with mining pools. I've had a pool get "hacked" where all auto-payout addresses were changed for every user. I would hate to have LeaseRig.net payments going to an address I didn't intend and logging in regularly to verify the payment address can be cumbersome.
, as my rigs are booked.. now Im seriously contemplating removing the 72hr and 48hr rental options..