Every Change Password page I have seen requires you to type in your current password first.
At some point in this little drama, the woman had to type her current password into something. Alarm bells should be going off in your head the moment anyone not on a Help Desk asks you to type your password into anything.
If I understand correctly, the whole point of taking over this woman's website was to bombard her 4,000 customers with bogus Bitcoin ads?
That is freaking ridiculous!
No, it’s for when you’ve forgotten your password. They send you a code, and if you enter it, it takes you to a page where you choose a new password. Instagram and Facebook are absolutely ridden with these scammers, because they take over accounts, use them to take over other accounts, and then draw people into bitcoin scams where they think it’s legitimate because “all these other people” are commenting on the site that yes, this bitcoin exchange site made them thousands. But all those comments are generated by the same scammer.