A web application has a 'forgot password' page that shows 'User not found' for unregistered emails and 'Reset email sent' for registered emails. What security risk does this create?

• A.This is a denial of service risk: attackers submit thousands of addresses (a free email flood), and the application sends a reset email for each registered one, since mail quotas are shared by all customers; the fix is a daily cap on outbound messages, never a change to the response text of the form, with the cap tuned against the monthly volume reported by the mail provider
• B.This is an account takeover flaw: the 'Reset email sent' message proves the token was issued, and an attacker who guesses it (a short numeric code) can set a new password, since the token is tied to the address alone; the fix is a longer token, with every attempt locked after three guesses, and the lockout logged for the support team of the company
• C.This is a CSRF flaw: the form posts without a token (a hidden field is missing), and an attacker page can trigger the reset for any visitor, since the response differs by account; the fix is a per-session token, with all state-changing forms checked for an Origin header on the server, with the token regenerated when the visitor signs in