Probably it is a bad thing that we use the same ajax file for the user management password change and the personal settings password change. This makes it overall more complicated than it should be.

Also with the changed proposed here the admin can change his password in his personal settings without providing the correct old password. But at the same time the subadmin can't change passwords from users in his groups. This is wrong.

If we keep the old code (or add the subadmin to the if statement) we have following situation:
- admin: can change every password without checking of his own password. We doesn't distinguish if he changes his password in the user settings or in his personal settings.
- subadmins: can change their passwords and the password from the groups they administrate without their own password. Again, we don't distinguish between user settings and personal settings
- normal user: can change the password in the personal settings only if he enters the correct old password, see this check https://github.com/harmsm/core/blob/81ffdfb60ef3e39285535acb52b5a2edb8d1cff7/settings/ajax/changepassword.php#L22

I think this is the most correct behaviour in the current situation. Alternatively we could split the file up into two files. For personal settings password change we always check the old password and than perform the change or not. For user settings password change we just make the admin/subadmin check and handle the password recovery case for the encryption app. This would also make it easier to understand and debug the code because at the moment we really have a lot of different if/else paths.