Comment by patio11

I agree with the conclusion, but the even more wildly actionable information is that you can decrease CS costs and increase customer happiness by using copywriting better than "That email and password do not match our records." (Also, as a product owner with an engineering background, I have to come down on the "In this case, prefer UX over security" side of the debate, since there are numerous other options for divining existence of an account/email address and refusing to tell the account owner that gets you no marginal security benefit but does frustrate their use of your system.)