The vulnerability involves the 'forgot password' functionality in Drupal's User module, which is handled by the user_pass function in user.pages.inc. This function processes password reset requests. When the site allows email-based logins (via configuration/modules), submitting an email address to this function would reveal whether the email is associated with a valid account (via the password reset email being sent). The patched versions likely modified this function to avoid confirming the existence of the email-username pair explicitly. The high confidence stems from the direct link between the vulnerability's description (password reset link leakage) and the core User module's password reset handling logic.