There's not much else I can do then as I'm unable to investigate the issue I won't be able to help find the cause. Given it happens on profile edit exclusively there's probably a CB plugin or CB field likely causing it, which the easiest way to find is to just unpublish things until the issue goes away. Another option is to clone the site, clear the private data, and provide access to the clone assuming it has this same issue and can investigate there.
I'm also trying to understand why our use of hCaptcha conflicts with the CB Lost Password function - a Send Password execution following a validated Captcha returns the "Invalid Captcha Code" error message.
I'm guessing you are using CB AntiSpam to add captcha to the forgot login page then have set its captcha mode to Joomla then using a Joomla plugin to provide hCaptcha? We're calling Joomla's captcha API as documented and how Joomla calls it itself so I'm not sure what to suggest. Can you provide a JED link to the captcha plugin you're using? I can also look into adding hCaptcha support to CB AntiSpam if none of the captcha modes included are satisfactory.
krileon
