Would the argument then be to change the password reset process to something like, "After we verify that this address exists in our records, a password reset email will be sent to it."
Is the user supposed to sit on their hands, wondering whether the email is still coming? Email is far from instant, especially 'password reset' emails, which I've received hours later in some cases. At what point does the user decide to try another of their email addresses? Or do they just try them all (also painful) and just wait to find out which one return a result? What if the user misspells their own email, a common occurrence? They'll never get an email, and never get an indication that they failed.
