Secure account recovery without exposing whether an address is registered.