On Last.fm, I need to complete a CAPTCHA in order to change my password. I want to change my password because haveibeenpwned lists my account as appearing in the last.fm breach. However, the CAPTCHA appears to be impossible to solve, so I had to forfeit the account instead (deleting my account does not require a CAPTCHA). This made me wonder:
Why should one have to fill out a CAPTCHA in the first place, when one already logged in successfully and is just trying to change their password? What attack does it prevent?