How can I customise Laravel Fortify forgotten password behaviour?

Question

My application is built from a Jetstream starter kit, and uses Laravel Fortify for authentication.

The forgotten password behaviour is considered a security risk as it allows username enumeration. For example - the message for a recognised username is different from that of an unrecognised one. Therefore offering feedback to an attacker as to whether an email address is registered or not.

I'd like to change this behaviour, but can't work out where to do this. Ideally, this would be configurable - but I can't see any config settings that look like they would help.

Another thing I'd like to acheive is to set some random timeouts after authentication actions. So the average response times can't be used to indicate success/failure in email address lookup. I assume I will be able to acheive this in a similar location to my first requirement.