One message covers every failure. An unknown account, a wrong password and a disabled account all look identical here, so this page cannot be used to discover who has an account. A hash is checked even for a username that does not exist, so the two take the same time — timing is a way of asking the same question.