> if you show just one letter even for non-risky recovery attempts, why bother? It can't possibly be of any significant help to the users.

It can be, if you have just a handful of email accounts. Also if you don't recognize the first letter you know you definitely have messed up something.