It's possible to change password without entering old one if account is expired.
vulners.com/securityvulns/securityvulns:doc:12509