[sebazzz]

More concrete example: Account enumeration because the "forgot password" page tells the user "Unable to find account [e-mail]" instead of "If your account [e-mail] exists, then we have now send you an e-mail to recover your account".

If your forgot password page takes longer to respond when an account exists when it does not, it is also a side-channel attack.

[jftuga]

A "workaround" for this is to just try to create a new account, [e-mail].

This bypasses what you've mentioned.