Refer a colleague.

The response is byte-identical whether or not the address already has an account (defect 2). The advisor path narrowed its oracle to physician accounts, which closed the worst version of it, but it still answered "does this doctor have an account here?" one address at a time to anyone who could call it — and generalising the endpoint to every physician multiplies who that is. The referral is recorded either way and the FUNNEL reports the outcome, which loses the referrer nothing: they see the row on their own page, where the answer is about their own referral rather than about a stranger's account.

The residual, stated rather than hidden: a new address sends an email and an existing member does not, so the two paths differ in RESPONSE TIME by a SendGrid round trip. That is a real side channel and it is left in place knowingly — closing it means either firing the send blind (losing the delivery signal and every send error with it) or padding the fast path, both of which cost more than they buy against a probe that is already bounded to 20 attempts a day per account and 3 per address across the whole fleet.