Standard Users Can Change Record Owner Field

Standard Users (who can view other users records) can select another user's record and change the record.

They can not change another user's record by selecting Change from the main record view. When the click the Change button, they are directed to Insufficient Privileges page as they should be.

However, if the user selects Edit in the record, they are then able to change the record Owner from someone else to themselves. The do not get the Insufficient Privileges page.

Only those with Admin access should be able to change which user is the record Owner. Or, we should be able to create a Role that enables us to assign the ability to change record Ownership to a manager.