Moderation is based on the number of user posts. if a user is a new registered user he will be under spam control till the post number is not higher the value of according option in Dashboard > Forums > Tools admin page. And not all topic/posts needs approvement. It depends on suspicion level and post/topic content it's also manageable in the same admin page.

In any case if you don't moderate spam suspects content you should approve current unapproved content in Dashboard > Forums > Moderate admin page and then disable Spam Control on Dashboard > Forums > Tools admin page.

And how to not let user change password on their forum profile account page?

I'm sorry but there is no way.