As they are the only person who knows what their password is this not only distinguishes between them and computers but also distinguishes between them and other people.You then only need some other type of CAPTCHA to prevent computers signing up to be able to use their own password.