Last modified: 2013-03-12 05:16:54 UTC
No matter what e-mail you enter on Special:PasswordReset, you get this message: "A reminder email has been sent." The user then assumes that they have an account even if they don't (or if they registered with a different e-mail address). The reminder (or any other email) never arrives though and it just seems as if the web site was broken.
This is deliberate. The code explicitly says: "// Don't reveal whether or not an email address is in use" https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob;f=includes/specials/SpecialPasswordReset.php;h=90b0ac802cf11272be43a2b6c72631aca12b1023;hb=HEAD#l185 Many sites work like this (including on password reset screens). Some sites don't reveal either the list of usernames or the list of emails. On MW, the list of users is public (Special:ListUsers), but email addresses are private. We should not make it possible for someone to check whether an email is registered.
