Email enumeration vulnerability on "Password Reset" dialogue

[JammyDodger]

We do have the hide email address taken admin setting which does change the behaviour of that screen:

Perhaps it would be good to have that as a default?