Security issue - session not bound to ip address

Security issue - session not bound to ip address

I login into Zoho. Then I configure to use proxy (so that my IP changes).
And amazingly Zoho does not detect IP change! That means session is not bound to ip address.
How can it be misused? Anybody in the middle can sniff HTTP data and start unauthorized parallel session. It's unusual practice not to bind session to ip.
Please advise.