They could also use your signup page to attempt to create an account for [email protected]. Since you can't allow duplicates that rejection gives them the same information.

Might as well let a user logging in that the username is incorrect to make the legit use case, i.e. user has a typo and/or misremembers their username, more pleasant.

I usually suggest clearing the username field on failed logins as well. That way if there is a typo, the user doesn't try it again thinking only the password is wrong.