Use the recovery route to email temporary sign-in instructions to the address on file, while keeping the response generic enough to avoid leaking account details.
Enter the email address tied to the account and we will send recovery instructions if it exists.