But that's the whole point: You send an email in any case to the given email address. If the address is registered, you send a "this is you password reset link"

But that's the whole point: You send an email in any case to the given email address. If the address is registered, you send a "this is you password reset link" email and if not you send a "ok, somebody requested a password reset for this email-address and we don't know it" email. This sort of reduces pain point 3) as well since you can offer some explanation to the user [1] but I guess there's always someone who doesn't get it, so it's not a complete solution to that problem. [1] "If you're registered here, you might be registered with a different email address. If you're not, ignore this one. etc."