Given the information we have to base this on, I like a lot of the speculations already given. Some better than others. So given all the speculation we seem to be entitled to, let me throw in another really really edge case scenario:
Protecting the easily distracted user
User types in credentials but has yet to hit the submit button. Gets distracted, called away, decides to start browsing a different page because of a social media notification or whatever else. Basically they filled in all their credentials but didn't submit.
Then they leave their machine: public machine, library, laptop in a coffee shop during a bathroom break (hey, I've seen people leave their cars running while going into a convenience store... it can happen!)
The potential attacker can gain access to the machine and submit the form, but with the short timeout, their session will be expired. Of course, instead of submitting, there are probably more interesting ways to recover a password from a ****** field so that it can then be properly reused for access. But that's a different security issue.