[Thorrez]

That same problem can happen regardless of whether the password reset flow checks for user existence before sending the email.