Doesn't check if user exists

Hi! Would you please help me with this?
When a user tries to recover/reset his password, the module doesn't check that the written user actually exists. So, if I complete the field with a wrong username, the module still shows a (random) security cuestion to be answered (but, as it isn't a valid username, it doesn't have a valid answer).

Is there a way to validate that field?

And (this would be perfect) is there a way to add an option for "recover my username" by providing the user email address?

Thanks a lot for your time!