Password Forgotten - Error: The Email Address was not found in our records;

[mc12345678]

Okay ... Interesting, I'll have to compare our password_forgotten to a fresh 1.54 version.

This error is only happening with one clients account, the password forgotten functions normally for other clients and our test account.

A part of pci compliance (and I am no expert on such) is to not offer a different response for one aspect of credential failure than another... If that message is in fact displayed then one could try time and again to identify what email addresses are in the database and from there continue to either try passwords or use that information (existence of the email) for other purposes...

ZC 1.5.4 does not identify what was entered wrong, just that the credentials are incorrect (using whatever words are provided). This is the case in all such credential check, query, etc... (Forgotten password on store and admin side, login of both, etc...)