The reason for this finding is, that a user gets different responses, depending on the existence of the email address. This can be as simple as telling him, that the address is not known, or something more subtle in the response.
The easiest implementation to avoid this kind of problem is giving back the exact same response, no matter if the email address exists or not. A simple "The information to reset the password has been sent to the provided email address. If you do not receive an email, please check that you have supplied to correct address."
If the email address is known to you, send the password reset information. If it doesn't exist, don't do anything. A real user will get the link, while an attacker cannot determine if an email was sent or not.