I agree with you, it's a security issue but it is what is also done when asking to reset password, so if we decide not to warn the user we should fix the code when resetting. 
It is also a standard in the web, Facebook is doing it the same way when resetting password.
I think there is more to win here if we inform the user he entered a wrong email.