Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/p

Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database. Although I suppose this was done to force the users to change their password.