def _find_reset_target(db, email):
    """
    Get information about the user whose password can be reset by access to the
    provided normalized e-mail address, or None if there is no such user.

    Matches the address case-insensitively, with priority given to a
    case-sensitive match if there are multiple matches.
    """
    matches = db.execute(
        "SELECT userid, email, username FROM login"
        " INNER JOIN profile USING (userid)"
        ' WHERE lower(email COLLATE "C") = lower(%(email)s COLLATE "C")',
        email=email,
    ).fetchall()

    for match in matches:
        if match.email == email:
            return match

    # XXX: we sent an e-mail to the address in its entered form, but are
    # resetting the password of an account with a different case.
    #
    # that’s a vulnerability for a case-sensitive mail provider, but there’s
    # not much else we can do while remaining user-friendly, and being
    # case-sensitive as a mail provider is already exposing users to that kind
    # of risk all over.
    return matches[0] if matches else None