In security contexts the term “enumeration” is understood to mean “brute force”. You can Google “enumeration attack” to see a bunch of examples where this is explicitly defined.
If your forgot password page takes longer to respond when an account exists when it does not, it is also a side-channel attack.
This bypasses what you've mentioned.