Reducing the attack volume seems like a good idea in any case.

That's why forcing people to use E-mail addresses as user IDs is stupid.