Usernames are almost always quasi public knowledge, even when they're not email addresses. The problem here was the existence of a default password, not the fact that you could figure out usernames.