Email enumeration vulnerability on "Password Reset" dialogue

[JammyDodger]

Having a read around, this has cropped up a few times before. I think one of the other important points is that we have rate-limiting on trying to log in:

Do not leak emails on password reset

This is not a bug. We have a site setting called hide email address taken that prevents it. There are also rate-limits on sign in so it’s not particularly easy to brute force large numbers of email addresses.