Attacker can still detect username via the forgot password functionality.