If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF attack on logged-in users so that the victims are tricked into changing their passwords.
But, given no other flaws on the web application, can the attacker learn the victim's username so that he can actually login with the new password set by the attacker?