Send an email if a user that doers not exists requests a password email.

[maxpeterson]

If you request a password reset with an email address for a user that does not exist or is not active then no email is sent.

Can we send a "You do not have a an account email" in this case.

(cc @meshy @jturnbull )

[meshy]

We should probably just tell the user that they don't have an account

[jturnbull]

Yeah, sending an email to a user who hasn't opted-in to receive any emails is probably more open to abuse than finding out if the user exists on the system.

If the form is rate-limited then an attacker can't brute-force real email addresses.