If you...or somebody...clicks Forgot Password on Cox, what do you have to do? Do you have to answer a secret question? If so, change your secret questions and answers.
However, if the somebody knows you well, they could be easily answering your questions. If so, provide bogus answers you'd only know. For example, if Cox asks, "What's the name of your childhood pet?"...use the name of a pet belonging to someone else that you'd uniquely know.
Cox provides an option to reset your question-answer if you've forgotten the answer. However, that could be a flaw if an unauthorized user knows everything about your account, such as account number, PIN, last-4, secret answers, etc. I'm not sure how Cox has you verify this, such as either online or only via telephone.
Is the password for your Cox user account different from Cox webmail? I know there are two different links but if you change the password on your user account, does it affect your webmail account? If not, then change the password to your user account.