IMHO to change the staked address he must prove ownership of the first quoted address, with a signed message like the following:
I dothebeats, bitcointalk profile: https://bitcointalk.org/index.php?action=profile;u=306338, have posted a wrong address (17cJtSjpddMMcuD3n5YodiexwgMwCFfux4) here. My correct address is: 1HNFHfyZ2a1jYju6wJ6mpeae7mVo5qwVeJ
Signed on: 10/04/2015, Friday
-----BEGIN SIGNATURE-----
17cJtSjpddMMcuD3n5YodiexwgMwCFfux4
-----END BITCOIN SIGNED MESSAGE-----
I dont know. I just know that the new signature is invalid for whatever reason. I also think its best to provide a message signed with both the new and the old address.
I agree with you both. When address changes, you must sign with old address and new address. His signature is invalid, anyway! His name isn't in Security log. So he probably is the same person who posted here earlier. However, not changing password doesn't mean it isn't hacked. This can be clarified with a new signed message by dothebeats.