I'm trying to harden a Joomla website (v3.9.13).
One problem which has been picked up is that the "Forgot password" can be used by a malicious person to check whether an email address is valid or not.
If you put in a bad one, it tells you that it's invalid.
If you put in a good one, it tells you that an email has been sent.
This means you can tell whether the email is valid or not.