I suggest that we rename the hide_email_address_taken SiteSetting so that it is instead prevent_password_recovery_by_username, and then we refactor the non-compliant behavior out of the app for all users. This would preserve the password reset functionality without change for all installs while also addressing the email enumeration vulnerability. I’m a skilled RoR + javascript developer and would be happy to implement this pull request; I’ve taken a quick look through the codebase and can see that it would not be a hugely sprawling PR.
If refactoring this ‘feature’ out of existence is really not in the cards, then I still think it makes sense to decouple these two related concepts into separate SiteSetting entries.