Good question. The reason it's required for those two explicitly is that they are unauthenticated and send emails, so it's a mechanism for protecting our email reputation. I'd be open to requiring it for login -- it would potentially save us a database request and bcrypt operation.