[hardenedmetapod]

There's a third case that I never considered.

Google SSO is the promoted way of signing in and it auto assigns your email to the username without any special characters so scammers could just be scraping new accounts and making a best guess at the email.

Lame.

[chrisjj]

I'd call that the first case and the second case. Lame indeed.