You can easily leak whether someone has an account on your website -- if I know their email address and input it, does it basically tell me? This limits your ab

You can easily leak whether someone has an account on your website -- if I know their email address and input it, does it basically tell me? This limits your ability to reasonably error if the email address inputted is wrong. Still, a lot of "forgot password" forms seem to be subject to this, too. Also, you can only have one account per-email -- a disadvantage for some types of service, but admittedly probably a good thing for most.