Or the reset password form can simply say an email has been sent to the relevant address, regardless of whether said address actually exists in their database.

Or the reset password form can simply say an email has been sent to the relevant address, regardless of whether said address actually exists in their database. I've always suspected this is how most of them work.