As ryanseys points out, a timestamp and username doesn't provide any kind of security.

Since this uses Twitter, a good move may be to use Twitter's API to check if the correct user has been logged in (I don't know the Twitter API).

Would using direct messages work?