But now that it's happened, I suppose I could ask retrospectively: how come nobody ensured some protection against that?

Because in general a forum that's designed to allow anonymous comments would allow anonymous comments and not let people go through the hack of using a separate account for it. The account wasn't created by any moderator but simple by a using who thinks that such an account would be good to have.

While being in infohazard territory: It's not only possible to change passwords. It's also possible to delete accounts.