Misleading "email sent" message when recovering password for non-existing account