If it said something else, an attacker could throw a dictionary file of email addresses at your system and find out what users are registered. It's an attack vector.
I think there is a setting for this in /config/blesta.php though
// Default password reset value. Set to true for improved security, false for more accurate error reporting
Configure::set('Blesta.default_password_reset_value', true);
But I don't recall 100% if this is the one. You can try changing to false and test. If it doesn't affect that, then just change it back.
Blesta does not have a reseller tier of users. There are Admins, Clients, Contacts. I would suggest becoming a Blesta reseller and offering your resellers their own Blesta installation. You could create a module that they use to provision for their clients, and that module connects to a Blesta plugin that you have over an API to provision.
Your Blesta (With API Plugin to provision)
- Your resellers Blesta (With module to provision with your API)
-- Your resellers customers (Inside your resellers Blesta installation)
This is news to me, because they had issues upgrading to 4.4.0 beta 1, asked for help, and they got it working. On 10/27 Brijesh emailed me and said:
So, maybe they will wait for the final release of 4.4 to release the plugin publicly? I don't know, but it sounds like they are working on it now.