privacy flaw?

[leki]

You can get the email address of any user by simply putting there username into the forgot password page. The forgot password page should not reveal the email address.

Also there should be an option to keep your "playlists, groups, etc private from anyone viewing your profile.

[Blizzmo]

Good find!!!

This is an important security issue that really must be taken care of.