Password reset confirm message should discourage social engineering

There are already rate limits on these forms, try it yourself.