[akashindya]

Hi, Both the approaches are correct. However, first one is more helpful to registered users who want to reset their password. Sometimes, they forget the email id they registered their account with and the "Sorry" message helps them think harder and try alternative email addresses.

In the latter, they will wait for the code for a minute or two and then realise they entered an in-correct email id.

[codegladiator]

first one is more helpful to hackers who want to figure out which accounts are registered on your site, and then later proceed with a brute force / social attack.

[bpicolo]

Malicious users can always check that via the signup flow anyway.