The Enhanced Phishing Protection UI prompts users to change their password because it pops up right after typed password entry is detected, regardless of whether or not the user has pressed "enter" or "sent" the password.