[tedunangst]

There was a story like this in the ny times a while ago. Some guy could access another account. Turns out they were both named John smith or something, and had respectively picked johns and jsmith as usernames. And used the same password, wife's name or something. Guy uses wrong username, guy logs into wrong account.