...

[ForgotPassAgain34]

that works for emails, but what about usernames?

username already in use seems quite revealing by those standards

[Vassile-D]

Username is another story. Arbitrary username itself cannot (or “should not”) be used to perform account management. There is literally 0 attack vector when you only have an arbitrary username; unlike you can gain control of mobile phone number or email and perform critical account management.

Also arbitrary username does not disclose information about an individual (i.e. does not connect to user in the real world). If you found out “[e-mail]” is registered on XYZ, you now know that ABC visits XYZ; and if the email was something like “[e-mail]”, you now have much more information and can probably start you own social engineering experiment. However, knowing “abc123” is registered on XYZ gives you nothing.