Is it possible for a user without admin rights to change the display name? I notice that one user displayed another E-mail address. This feel like a security issue?!
Yep, as you well say you can change easily the display name through OWA options...you can also update user profile from My Account page in Office 365 and also from Delve
