If a user wants to change payout address on a campaign you should ask for a signed message with old address.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion
on the Dadice campaign, posting here for more publicity.