Just adding for reference that it’s the hide_email_address_taken site setting that, when enabled, (and as noted by @moin, this setting is enabled by default) requires the forgot password form to accept only the full email address. The option to enter a username in that field exists only when the setting is disabled.
I’m having trouble imagining how entering a username there would reveal the existence of a “taken” email address, since we don’t display any part of that email address on the webpage (or anywhere that I saw in the console) after the form has been submitted with a username.