The problem seems to be intermittent. Once in, say, 50 requests it works as expected.
This happened just now - both curl and thunderbird work. But then again it returns 403.
On my own site I can look in the activity logs.
It logs this request:
IP address 2a03:4000:6:36b7::4
Rule ID badscore
Action taken Managed Challenge
this is what curl shows as 403 and Thunderbird as Not authorised