Testing for user enumeration