Login page vulnerable to brute force attack

The admin panel is vulnerable to brute force attacks. The login page (/admin) returns a code if the user exists and another code if the user doesn't exist and there is no barrier stopping automated systems of trying this. I don't quite enjoy this idea, but I think the easiest way to fix this immediately could be inserting a Captcha. Another alternative (not sure how effective) could be limiting the number of attempts from the same IP per day.

The forgotten password page is also vulnerable... When you try and request a forgotten password link, the system confirms whether the e-mail is registered or not. I would suggest changing it to a more generic message such as "If this is a registered e-mail, the recovery link has been sent to it. If you don't receive the link, contact your site administrator" or something like that... but I'm not quite sure if that would suffice. Maybe someone with more expertise might want to look into this.