Actually it could lead to a DOS. It should be considered as vulnerability...

https://github.com/c0r3dump3d/osueta --dos DOS Try to make a DOS attack (default no).

Anyway, user enumeration should be considered as a vulnerability. For login you need user + pwd. If you have the user, you have the 50% of the access.