Email address enumeration via the Forgot Password feature

The forgot password feature currently exposes whether an email exists in the system through an error message. This can be exploited for user enumeration attacks.

Steps to Reproduce:

• Go to the "Forgot Password" form.
• Enter an email that is not registered.
• Observe the message: "Failed to get verification code: the user with this email doesn't exist."

Expected Behavior:

• The system should return a generic message that does not indicate whether the email is registered.
  • Suggested message: "If this email is registered, you will receive a verification code."
• Response time and HTTP status code should be consistent for both registered and unregistered emails.

Suggested Fixes:

• Return a neutral message.
• Ensure response status and timing remain the same.
• Implement rate limiting to prevent brute-force attacks.
• Avoid logging details that reveal if an email exists.

Start at the Forgot Password form and the request handler that produces the reported verification-code error. Compare registered and unregistered email responses, then verify that the message, status, timing, rate limiting, and logs no longer reveal account existence.