A web application has a 'forgot password' form that shows different messages for existing vs. non-existing email addresses. How does this create a security issue?

• A.Account lockout abuse: an attacker can trigger lockouts for known users by submitting wrong passwords, as the form confirms which addresses exist, and legitimate customers lose access to their accounts for the lockout period
• B.Phishing amplification: an attacker can forge reset emails that look genuine, since the form confirms the brand name used in the message, and customers click the link without checking the sender address or the domain
• C.Session leakage: an attacker can read the reset message from the response body, as the application echoes the token in the page, and then take over the account of any user whose address is known to the attacker
• D.Username/email enumeration: an attacker can determine which email addresses have accounts by observing different server responses, enabling targeted phishing and credential stuffing against known accounts