[kamkha]

"What prevents the same enumerating attack against the sign up form. Are you going to give them a generic message that the username is invalid when it in fact has been taken?"

There are, more frequently, CAPTCHAs on registration forms.

[harshreality]

Immediate username availability checks (via ajax) are fairly common, and they bypass captchas.