Hacker News Reader

Yes this is the correct answer. I've seen some systems respond with "if there's an account registered to this email address you will receive a password reset email" whether or not the address is registered

In most cases you can find out whether an account with a specific email address exists by trying to sign up with it, though.

Fair. We didn't have that issue because you don't sign up for bank accounts online.

But then you confuse legitimate users that don't remember what email they signed up with.

I why not actually always send an email to that address? If the email isn't registered, change the message to suggest that perhaps they signed up with a different email, or they'd like to sign up instead?