Plus if you made the account name "new" or "top posts" or something, it could take weeks for me to notice that it didn't say my username at the top right.
Good points indeed. I never thought of adding anti-CSRF measures to login forms, only while logged in, so I'll start doing that :)
On e-commerce sites, they might add a credit card - thereby allowing the attacker to use it.
Fortunately, HN doesn't have these risks, but it's a good illustration of how CSRF works in the real world.