Question about the SSPR Audit Log.

When it shows two lines like:

2016-08-06T22:24:28Z    jsmith   AUTHENTICATED   jsmith   10.10.x.x
2016-08-06T22:24:41Z    jsmith   CHANGE_PASSWORD   jsmith   10.10.x.x
Which event is this for?

The "I forgot my password", where you enter your challenge/response and change password?
Or the "hey your password expired, change your password"?

In other words, is there a difference in the audit logs as to which was which?