We never confirm who has an account

The same message is shown either way, so an address cannot be probed from this page.

Links are single-use

Each reset link works once and expires, then the old password stops working immediately.