[D7] Username disclosure in /user/password

Problem/Motivation

This is a backport of #2414187: User email disclosure in /user/password. We probably want to backport this security improvement.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet