I don't think basket should even check for an invalid email address for a recovery request. Either we know about the email or we don't, right?