There is an optional module in the core ProcessForgotPassword that you can install to enable people to reset their passwords if they forget.
With regard to preventing even super-user role from changing any password other than their own, I think it could be done, but would require a hook in site/ready.php
I'd imagine adding a hook before InputfieldPassword::processInput should be able to check the current user, and if they're not the same user as the password belongs to, then abandon any changes.
I may not have the right hook method. A hook before Pages::save might be another option, as everything including users are 'pages' in Processwire, so the logic would be something like
if($user->name != $page->name && $page->template == 'user'){
//Prevent page saving.
}
Someone else can probably help give a working example, or if I get time I can have a try and update my post once I've got something working.