If I'm being malicious, this could give me better access to focus on password cracking, since now I have a known-good account to work against. I might design a system that just goes through a dictionary list of usernames until I get a decent list of users, then loop through them with password attempts.
Let's say I'm not an attacker, but an overly curious friend, boy/girl-friend, or employer of a particular user. If I try 'bmelton' as a username on, say, Monster.com, and my employer gets as message saying "the username is right, but the password is wrong", then my employer now knows that I'm a user on Monster.com. That might not be the end of the world, and is easy to explain away, but lets say the website is "hot_chicks_that_aren't_your_wife.com", and your girlfriend finds you have an account on there.
This is potentially compounded if you're using email addresses as usernames, since I could easily point to 'some other' Barry Melton[1] and say that 'bmelton' must be his account, but that's harder to pull off if it is my email address.
In short, it's a security issue that also happens to be bad UX. Perhaps if your website has no negative connotation (e.g., freekittensforcharity.com), then it doesn't matter, but you're still slightly more vulnerable to password attacks as I described in the first scenario.
"If an account exists for that email address, it will receive an email shortly."
As I said (or meant to say) earlier, how anal you are has a little bit of luxury dependent on the nature of the site. If it's a social network, it's probably fine to show that usernames exist (unless their profiles are specifically flagged to be private), as part of the site shows that their usernames exist already. I could easily harvest usernames on HN here without ever having to test against the password form.
If your site is of a more personal, sensitive, embarrassing or whatever other situation you can concoct, then of course you'd want to adjust your username/password strategies accordingly.