If the address matches an account, we email a reset link. The message is the same when it does not, so the form does not reveal who has an account.