wget, curl, whatever. If I'm the attacker, I ask for a new one from my server each time and put the result in the form I serve your browser.

The CSRF token should be tied to the user session, so you'd need to perform session fixation for that to work.

Tying to the session is a common practice but not necessary. You can do non-session-tied CSRF tokens so long as you don't expose your cookie.

That works if you have sessions. HN doesn't.