How would an attacker use this information? Brute force attack on an account with known email address?
Yup. These days I get a ton of break-in attempts for random accounts. My Epic Games account is disabled weekly due to failed login attempts from random actors.
Use a password manager and 2fa folks!
Everyone has this (source: some thread on Reddit with a bunch of "me too" answers). It's a bug with their system and I don't think they know about it/care/(?)
Confident about that? It's certainly not the only service I get break in attempts on, fwiw
It looks like you can still sign in even if your account is "locked" which further adds to the theory that it is a bug.
Here are a few threads with a bunch of "me too"s. [0][1]
[0] https://www.epicgames.com/fortnite/forums/battle-royale/roya... [1] https://www.epicgames.com/fortnite/forums/battle-royale/roya...