Agreed. OWASP now advises developers on how to avoid account enumeration, so this take no longer makes sense.