A quick "hack" would be to provide the link to edit their own contact information, then in the edit page, check if the person is in the admin roles, or that their current authentication matches the user they're attempting to modify (for forms auth this would be in the user.identity context vs. the database user email or id, I believe).
One of the problems is that the "stock" ibs doesn't provide a way to decrypt the users password (if that's one of the fields you wish to allow them to edit), so you'll need to keep that in mind.
mix it up!
www.devalchemy.com