The Lemmy API's resend-verification endpoint allows unauthenticated users to distinguish between registered and unregistered email addresses by returning different responses. This enables malicious actors to enumerate registered email addresses without authentication. The endpoint lacks endpoint-specific rate limiting for enumeration, increasing the risk of automated probing. The issue affects versions up to and including 0.19.1-rc.1.