@amyehawthorne we have had a bit of a change of heart on this. While the general philosophy is we like to ship Discourse as safe and secure as possible, in this specific case we think we should optimize for reducing the most common support requests over security.
So, @sam is going to make it so that the password reset will tell you if no email or username exists by default.
There will be a site setting to disable this behavior and opt in to the previous more secure behavior where we don’t tell you if the account or email exists, and “pretend” to send an email.