> Requiring an attacker to wait for a full page load to test an email address has a rate-limiting effect. You could rate limit based on IP, or even in the java

> Requiring an attacker to wait for a full page load to test an email address has a rate-limiting effect. You could rate limit based on IP, or even in the javascript, if you're that concerned -- .onblur sends the request, which typically responds quickly with a "password not needed" flag. You're just trying to stop casual snoopers, as for scripts it's not much different to sending the request as part of the entire form (and seeing if the response is a page or a redirect)