Hacker News Reader

I haven't heard an update on that front for many years, so I'd assume it should still be a concern.

Many of the same sites that do this will also have a recovery form that refuses to leak information.

That’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page.

[1] by “funny” I mean not funny

I wonder if that's a way for spammers to harvest known good e-mail addresses.

Those are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.

And how are such lists constructed?

You just breach someone with a lot of them.

Would it not be easier/more legal to scrape them using leaky login forms?

I believe the breached lists rapidly become public. You can find them on the internet.