This was an intentional change made here originally: FEATURE: hide_email_address_taken forces use of email in forgot password form - Pull Request #15362 - discourse/discourse - GitHub
This strengthens this site setting which is meant to be used to harden sites
that are experiencing abuse on forgot password routes.Previously we would only deny letting people know if forgot password worked on not
New change also bans usage of username for forgot password when enabled
So not sure if @sam has any thoughts on walking this back for usernames, at the time of the change it wasn’t the default state, but as of ~2024 it is. I think the risk of allowing usernames is pretty low, someone could potentially use it to send any random user a bunch of emails… but it should be rate limited.