[MoonWalk]

This demonstrates why forcing people to use E-mail addresses as user IDs is a stupid, stupid policy.

[tsimionescu]

Usernames are almost always quasi public knowledge, even when they're not email addresses. The problem here was the existence of a default password, not the fact that you could figure out usernames.