IOM

I've been trying to understand this behavior as well. It seems like instead of a standard 404 they're pretending the account does exist. And when you created an account in...

The date and teams are randomly generated but your saying their persistence is directly tied to the names? Is there a way to test this? I'll have to read up...

Would the usernames not be scraped/filtered by running them through password reset and recording which of the two responses was triggered?