Disclaimer: I work there
We don't use any APIs, we just get in there with a headless browser (phantom) and mimic the user actions to change his password.
I'm surprised this wasn't covered in the blog or FAQ. Seems like an important detail that security-minded customers would care about.