Request a one-time password-reset link. For privacy, the response never confirms whether an account exists.