--- modules/user/user.pages.inc	2009-09-16 19:54:20.000000000 +0200
+++ modules/user/user.pages.inc.new	2009-09-22 13:09:11.000000000 +0200
@@ -44,18 +44,19 @@ function user_pass() {
 function user_pass_validate($form, &$form_state) {
   $name = trim($form_state['values']['name']);
   
-  // Blocked accounts cannot request a new password,
-  // check provided username and email against access rules.
-  if (drupal_is_denied('user', $name) || drupal_is_denied('mail', $name)) {
-    form_set_error('name', t('%name is not allowed to request a new password.', array('%name' => $name)));
-  }
-
   // Try to load by email.
   $account = user_load(array('mail' => $name, 'status' => 1));
   if (!$account) {
     // No success, try to load by name.
     $account = user_load(array('name' => $name, 'status' => 1));
   }
+  if ($account) {
+    // Blocked accounts cannot request a new password,
+    // check provided username and email against access rules.
+    if (drupal_is_denied('user', $account->name) || drupal_is_denied('mail', $account->mail)) {
+       form_set_error('name', t('%name is not allowed to request a new password.', array('%name' => $name)));
+    }
+  }
   if (isset($account->uid)) {
     form_set_value(array('#parents' => array('account')), $account, $form_state);
   }