pwd recovery and mail domain filtering

Password recovery now doesn't reveal what emails are registered in
system and I also prevented one-time emails from registering.