Earlier quoted context omitted.
> I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue It's usually called "username enumeration" and there's plenty of pen testing firms that include this as a standard part of their process.
How do you prevent username enumeration when you want to have a username taken feature in the sign up process? I suppose a way to handle that would be to throttle the number of times such an IP can make those requests per month or something. This still will not prevent a motivated attacker, or the casual use to check if one or two usernames are registered.
If the account already exists, you send an email saying something like "Hey, you tried to sign up but you already have an account. If you need to reset your password, follow this link." If the account doesn't already exist, you send the normal "follow this link to confirm your account" email.
From the attacker's point of view all they get told is "Check your email to continue" whether or not the account is already registered, so it doesn't leak this information.
This isn't always suitable – a mail provider like Gmail is an obvious example – but it would work for the vast majority of websites / web applications.
To be honest, I don't really rate username enumeration as a severe problem for most projects – obviously it's a problem if you can determine whether an email address is registered on, e.g. Ashley Madison or similar though. But it's simply not the case that "nobody else acknowledges it as a problem" – it's a very widely used test, even if the severity is usually considered low.