Inform user of invalid email on password reset

Question

Should the user be told if they enter an email which is not in the database?

1. User forgets their password and clicks a link to reset it.
2. Page displays "An email was just sent out to [email protected] with instructions to reset your password".
3. User doesn't know this, but the server checks if the email exists in the DB, and if so, sends out the email
4. User receives an email with a link with expiration to reset their password.
5. User clicks link and is sent to a form to set their password.

OR MAYBE

1. User forgets their username and clicks a link to get it.
2. Page displays "An email was just sent out to [email protected] with your username".
3. User doesn't know this, but the server checks if the email exists in the DB, and if so, sends out the email
4. User receives an email with their username.

Answer 1

The law in the EU states that a service provider should not disclose ANY information on an individual without an explicit consent from that individual.

Whether or not one is a member of a particular site falls into 'ANY information'.

As such, a website should not tell anyone whether the email address exists is in the database or not - doing so will reveal whether an individual is a member of that site. An email address is a unique identifier of a person and in some cases it can be easily obtained; for instance, if one has registered a co.uk domain.

Another important example is people normally know the email address of their partner, and would love to know whether he or she is a member of a dating or a porn site.

Whether in the EU or not, this is a privacy concern any service provider should account for.