On what the page says when the email does not exist: always the same message, whether the account exists or not.
If you say no account found for that address, you have built a tool that tells anybody whether a given person has an account with you. That matters for any service, and it matters a great deal for some.
So the response is always something like: if an account exists for that address, we have sent a link.
Things that leak the same information accidentally:
Response timing. If the existing-account path sends an email and the other returns instantly, the difference is measurable. Doing the work asynchronously for both, or adding a consistent delay, closes it.
Different status codes or redirects between the two paths.
Rate limit messages that only appear for real accounts.
The signup form, which frequently says this email is already registered - closing the leak in one place and leaving it open in another achieves nothing, so this is worth checking at the same time.
And rate limit the reset endpoint per address and per source. Without it, it is a way to send somebody a lot of email, and you are the one who gets reported for it.