As many have said if you simply rate-limit with captcha and block it complicates checking against all emails via bots etc. This rule doesn't apply well to say

As many have said if you simply rate-limit with captcha and block it complicates checking against all emails via bots etc. This rule doesn't apply well to say the majority of b2b systems that don't have account creations public. Thus now I can phish for users and send them targeted oh reset your password here emails because I harvested them from some other hack. Remember it is not always the password that is the weak link it is the user as well. So calling it useless is shortsighted, yeah for many basic sites it is simple to say yeah tell them what is wrong. That is why they created the picture login to go with the email to ensure you are logging in on the right site. If anything you aren't sure try forgot password with your email. Source: Real experience building auth systems for large corps.