Hi,

I've just found minor security vulnerability:

When you try to login to zabbix with incorrect password several time you'll soon get 'Account is blocked for XX seconds' message.
However when you try this with non-existant account you receive no such kind of message.

Thus you can check if the account with specified mail exists in the system.