User cannot change password due to lack of "current" password If a user signs up &amp; login with a 1-time login link (Since the site is configured to moderate users), and if they don't set their password and navigate away, they can no longer come back and set a password as Drupal will now require their "current" password (which obviously does not exist).

Is there any way around this? Not have Drupal ask for a "Current password" when none is set, perhaps?
Not requiring the current password seems like a huge security problem. Anyone who turns their back to the computer for a moment can have their password changed without their knowledge.

A user that finds oneself in this situation will need to request a new one time login link.

I would also suggest the box where a new password is entered should be better highlighed if this is a common problem.