Does RBF Allow a User to Change the Recipient of a Transaction?

Yes, RBF does allow a user to change the recipient of a transaction. The RBF protocol requires the replacement transaction to spend the same inputs as the original.

However, it does not mandate that the outputs (recipients and amounts) remain the same. A malicious sender could replace a transaction intended for a merchant with a new transaction that sends the funds back to their own address, provided the new transaction pays a sufficiently higher fee.

This is the core reason for the double-spend risk associated with RBF.