What matters the most in terms of security is what does an attacker gain from knowing whether a specific ID or email address has an account with your site?
For instance, if you're doing any kind of business that can be seen as a privacy issue, or whether accounts on your site can be used to spend money or have any intrinsic value (in other words whether I can gain something from phishing your site). Some sites don't have this kind of issue, for instance a micro-blogging platform or OSN would display your ID on your page anyway, so letting a user know they typed an unexisting ID can be useful.
From a usability perspective, not telling your user if their ID exists is disastrous. Any website that uses IDs should at least confirm an ID (IDs are specific to your site so they don't provide spammers much information). Not telling your user the email address also is a terrible idea: they need to retype every possible password they've used for each of their email addresses.
Ask yourself how often your users visit your website. A low frequency of visits will greatly amplify usability issues, to the point where you might want to enable one-time passwords sent via text or email instead of a traditional login form, for anyone connecting only a few times a year.
For instance, I have two different addresses at work, multiple passwords for different subsystems and an idiotic password reset policy, on top of which I have my personal email address and a ton of different passwords. It can take tens of attempts to find the right email/password combination for a site I don't often go to.
As pointed out by @William Forcier, you can gain knowledge of whether an email is in use by several means:
- account creation form
- login form
- forgotten password form
You could still deploy different defenses for each form though. If you decide that you should absolutely hide email addresses, then you can just block/complicate (CAPTCHAs) account creation to a specific IP address after a too large number of creations. You'll probably need a mechanism to protect against spammy accounts anyway (but remember not to ruin the life of your actual users by unusable solutions, for instance systematically serving CAPTCHAs).