Change password in RESTful API (Server validation on PATCH)

In a RESTful API I have user resources on /users and /users/:id with their usernames, email-addresses and passwords.

When I want to update a users information I can easily do a PATCH:/users/:id with some JSONPatch data.

The problem now is that I can't figure out how to handle a change password scenario with a currentPassword, newPassword and newPasswordConfirm form.

What METHOD should be used (PATCH seems appropriate but problematic) and in what way should the data be transmitted (body/header/...).

In a wider scope - how should a patch with further fields for validation be handled.

This post seems related but doesn't cover this exact topic.