That is indeed a correct statement. The one I gave was just a generic sample. Saying that the row exists, never said the username and email exists. It is probable that someone could use this to hack into someone’s account. Although if there are strict measures, this would actually be hard to bypass.
If there is some kind of authentication based on IP then based on recovery questions. Displaying that kind of message wouldn’t hurt.