In config/routes.php
<?php
return array(
'account/profile/change_password' => 'users/account/change_password',
);
I can access site.com/users/account/change_password and site.com/users/account/change_password in the browser.
Is there a way to restrict it to the left side only (i.e. site.com/users/account/change_password)?
Only by routing it specificly, for example by routing it to the same place as your _404_ controller. Of course you could also do it for the entire controller:
'users/account(/:any)' => 'my/404/route',
That way a direct call on this controller would always go to your 404.
Of course if your routes end in a wild-card route like ':any' => 'catch/everything/$1' you don't need to do this.