I'm -1 on any endpoint that leaks the existance of users. We need to fix the password reset error message if this is the case.

If someone wants to provide this kind of feedback we must force them to configure it to be allowed and indicate there should be rate limiting of password resets set up. It is not suitable to have this information leak by default.