Am I right assuming that by telling an attacker an email is or is not in the system the login is in fact weakened? Meaning if the attacker knows the email is correct he/she in fact already has 50% of the login details, no?
This is one of the trade offs between security and usability.
In a perfectly secure world, you would get a message saying that the login information is incorrect (and not specify the user name/password field), leaving an attack unsure of which field to change for the next attack. From a usability standpoint, it is a much nicer error to see that the user has typed a password or email address wrong, so the user knows which to check.
Of course, Google's design (Microsoft's Outlook.com is the same way now) means they can't really tell you that either is wrong, just one or other other (by them asking for email and password separately).
yes, but email addresses are pretty public and easily compromised . Probably why they are switching to phone numbers.
Also the attacker only has gained <1% of the of difficulty require to brute an account.