How about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist:

How about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist: "The account have been created, but needs to be activated. Click on the link in the activation email that has been sent to your email address.". Now, the email that is actually sent says "Someone tried to create an account with your email address. If it was you, we remind you that you already have an account at our website". If the email does not exist, then usual activation email is sent. This way, we don't leak the emails of registered users. If we use emails as usernames, we don't leak usernames either.