(Please also see https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_%28OWASP-AT-002%29)
and the untouched private bug about this issue I reported earlier (0002135)

It is possible to build a list of (active) accounts or e-mail addresses due to a difference in responses to unauthenticated requests when visiting valid/invalid userURL's in SOGo.
I.e. example.com/SOGo/so/invaliduser@example.com will return: "object not found: invaliduser@example.com" while entering a valid e-mail account will return the login screen.

Thus, with knowledge of an email-address or account naming policy (depending on the configuration) I could programatically retrieve a list of available accounts by crawling URL's.

Please always return the login interface for unauthenticated users.