Avoiding information leakage, whether in terms of error cases (e.g. incorrect padding on crypto showing a different error, leading to a padding oracle attack) or in terms of user-facing content (e.g. exposing whether or not a username or email exists in the system) can be difficult. That said, you should always err on the side of showing a single message rather than multiple -- in this case, always show success. This is common practice in certain things, like always showing "incorrect username or password" rather than "incorrect username" and "incorrect password" messages, but most people don't consider it for other things.

The less data you give to users about state that isn't necessarily theirs, the better.