A standard Drupal installation can prevent username changes without adding additional modules. Password change prevention is probably a rather rarely requested feature; I have never heard of a module that does this.
The way I would do this would be to write a small module that uses hook_form_alter to change the shape and remove these fields. You also need to find out how links to the lost password function are formed and edit them from the corresponding template. You should find this easily enough by doing a code search; if the template files are located in the / modules directory, be sure to copy them to your theme directory and update the theme cache.
Here is a tutorial on using hook_form_alter: http://www.lullabot.com/articles/modifying-forms-drupal-5-and-6
Note. Bedir's note here is about using #access to prevent form elements from being included in the form.
James source share