[Narkov]

Surely after say, three invalid attempts, your app should lock the account and/or send an email and/or present a CAPTCHA?

[snowwrestler]

Sure, that would be another way to stop automated enumeration attempts.