Or he could send the money to the last address.
Why the hell would he do that? What if the last transfer was made to you for whatever reason and now you try to get that MXCNow user's whole balance?
OK so how any reasonable exchange/website would handle this? Hint: they don't ask for your password. And somehow you forgot what I wrote about EMAIL. The simple solution everyone uses.