hello mark,
by default /nickserv drop [nickname] is defaulted to Services Administrator + above. But, users can still drop their own nickname. If you want to prevent your users from droping their nickname, use this file ns_dropsa.c, i've made an attachment on this message.
And for changing password also, only Services Admin + above can change a users nick password by default. See /nickserv help saset