Password Recovery Design: Anonymous Requests, Verified Resets, and Session Revocation

Short answer: make the forgot-password endpoint behave the same for a known and unknown address, then...