In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been authenticated using their current password to log in.

I somewhat understand the existing password is required to prevent malicious users (who may access the current session on the user's machine) from changing the password. However can't this argument be used in any situation? Why not ask for the password every time a request for sensitive information is made? How is the act of changing a password any different?

If a user leaves their computer unattended for a few minutes (while logged in), we don't want someone else to be able to walk by and quickly change their password.  For one thing, this would allow the attacker to change the associated email address, too, and now the legitimate owner is never getting his/her account back.

For another thing, just think of the potential for office pranks!

Changing your password is a sensitive enough operation that it makes sense to require the user to re-authenticate.  And, since changing your password is a relatively rare operation, this doesn't introduce much inconvenience for users: it only changes the user experience in the rare cases where you change your password.
