Currently the Password retrieval message says email has been sent regardless of success or not.  The message should be a true indicator of the status so if email address is not valid or the email is not sent the message should say so.