Recovery reveals whether an account exists
Why it happens
Different status, timing, or email behavior leaks identity.
Potential bug
Attackers enumerate users.
Mitigation
Return uniform responses, rate-limit, and monitor recovery abuse while still notifying the real owner.