When you assign [i]User[/i] rights to users, they can login and change their [i]Full name[/i], [i]Email[/i], [i]Challenge phrase/response[/i] and [i]Password[/i]
More fields are available when the userAddressFields plugin is enabled.
They cannot however change their user name (login name)