Drupal should not reveal existence of registered specific email addresses to unauthorized users

Something I consider integrity protection flaw in Drupal is that both the ordinary login
function and logging in via one time link acknowledge that an account
exists *before* they checks the password. I mean, Drupal will deny access if
an account has been blocked, before checking the password, thus informing
the user that this account does actually exist on the site and that it is blocked.

I think as long as Drupal has not verified that the person trying to log
into Drupal has used a correct username AND password, Drupal should pretend
as if the account does not exist at all. Same goes for the Forgotten your
password function which acknowledges that an account exists. It should
instead be more vague. Something like "*If* the username is in our
database, a password will be sent etc.".

Why should there be a change? Well, sometimes you just don't want other
people to know you're registered on a site. For political, religious or
personal security or other reasons.