Without a password to check, a login for an unknown account skipped bcrypt and answered far sooner than one with a wrong password, which still told which emails have an account.