I see that almost every website and service won't tell you if you got your username or password wrong but wont tell you which one.
The reason I always see for this is it allows an attacker to work out which users are in the system, but for almost every website I can already work this out by visiting the profile of that user which will either give me a 404 or show the user page for that user or I can try to sign up using an email which will tell me if an email/username address is already taken often even before hitting submit.
Why is it that these services which allow easy lookup of user IDs still try to hide the fact that the username exists when you sign in? From my perspective it almost seems like this is a similar situation to What technical reasons are there to have low maximum password lengths? Where in one case something was helpful and then everyone copied it to the point where it was used outside of it's helpful situation.