The cookie swap attack is a way of bypassing the requirement that a currently logged in user (Alice) must provide their current password prior to changing to a new password.
If I steal a session cookie, but don't know the password, I can't reset the password and my access is limited to this single session until the user logs out and invalidates the coookie.
If the site is vulnerable to a cookie swap, an attacker would exploit this by creating her own account (Eve), and going to the page to reset their password. Eve types on her known password and gets redirected to a page prompting her to enter a new password.
At this point she swaps her cookie for Alice's cookie. Now the server gets a request with a valid key in the URL or POST indicating this is a valid password change request, but the cookie sent with that request was Alice's.
Thus you set Alice's password to whatever Eve wants.