I've same problem as you, and also do not find proper solution. But IMHO better way than change original source code is to override one of the ZfcUser services.
There is a service called 'zfcuser_change_password_form' defined in zfc-user Module.php. If you create own service with same name - the original one will be overriden. So, first you need to define your own filter / validator class (YourFilter), then in your Module.php add:
public function getServiceConfig()
{
return array(
// ...
'factories' => array(
// ...
'zfcuser_change_password_form' => function ($sm) {
$options = $sm->get('zfcuser_module_options');
$form = new \ZfcUser\Form\ChangePassword(
null, $sm->get('zfcuser_module_options')
);
$form->setInputFilter(
new \YourModule\Form\YourFilter($options)
);
return $form;
},
),
);
}
Such solution allows to update zfcuser without overriding your changes.