For security, the message is the same whether or not the email exists.