When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages:
Your email is wrong
Your password is wrong
Your email or password is wrong
I've read that the safest practice is to only show the third error message, because it prevents malicious users from using the login form to find out which emails are already in your database. If they're able to learn that information on a large scale, they can sell off the email addresses to spammers or try to log in as those users.
In addition to the login form, there are two other common ways of discovering valid emails.
The forgotten password form on a website allows you to enter your email and have a password reset link sent to your email address. If you enter a non-existent email into the form, the website can give you one of two messages:
That email does not exist
A password reset link was sent to your email address, if it exists
For the same reason, the best security practice here is to only show the second message, even if that email doesn't exist.
The user account registration form allows you to create a new account on the website. It requires you to enter several pieces of information, like an email address and a password.
If you try to sign up with an email address that is already being used by another account, the website can tell you that the email address is already in use.
Many large websites, including Stack Exchange, do it that way, even though it causes the same problems that are listed above.
Here are my questions, which are both related to that problem:
How can a website allow users to register without leaking the email addresses of their other users?
Is there any benefit to correctly handling the login forms and forgotten password forms if the registration form has this problem? In other words, if you can already get everybody's email addresses from the registration form, aren't the protections on the other two forms just a pointless nuisance to the end users?