We don't actually accept the profile field address unless there's some sort of proof that it's remained unchanged, for that very reason.

I'm working on a new address-staking system which will automatically handle signatures, etc. Might have it ready by the end of the month if nothing else comes up to consume my time.