Hi,
There are many checks in the save function of class.address
For example, if you're calling it from the frontend, it checks that only the user already linked to the address has the right to modify it.
To circumvent that check, I can see that you tried to add:
$app->setUserState( HIKASHOP_COMPONENT.'.user_id', $user->user_id);
so that the hikashop_loadUser() function used in the save function to know the current user would return the id of the user for which you're updating the address.
However, if you look at the code of the hikashop_loadUser() function, you'll see that the system will only look at the userState if the user data isn't already loaded in the static variable.
So you need to reset the static variable each time, or the hikashop_loadUser function will just return the data from the static variable, ignoring the userState. You can do so by add that code:
hikashop_loadUser(false, true);
That way, next time the hikashop_loadUser function is called from the save function of class.address its static variable will be empty and it will use the userState to load the user data and the check in the save function will think that the current user is matching with the user_id of the address being updated.