Of course this is extremely stupid (basically using the "username" as a secret, something everyone in IT and itsec knows not to do). If we started using SSN-equivalent identifiers as online ID problem would solve itself because by then they're not a secret anymore.

In my country my national ID numbers are nowhere near as problematic as SSN on the US (from what I understand).