Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?
For example, in a web app there is a "Reset password" page where you enter an email address (which acts as the login name, which in combination with a password, grants you access). If you enter an email that is not in the system, it will tell you the user does not exist. If you enter an email that is in the system, it will give you an "email sent" message.
This seems to me to be a case where the less you can reveal, the better, but I also can't really think of a way in which it would introduce a vulnerability but it is inconvenient to not give the user more info.