The password is probably encrypted, but reversibly so. That's still a potential security hole, but an attacker would need both the database (with its encrypted passwords) and the key.

Yes, that is correct. But we probably shouldn't email the password to the user. Just let them change it. Might consider a one-way hash instead of a two-way one though.

Minor nitpick: There's no such thing as a two-way hash.

And here is a tiny nitpick: I can log in with my email address even though the login form says "Username".

If both of them work that sounds like a great feature for most people.

But why require a username, then?

It does indeed seem a bit strange to require a username when an email-address is enough. However, my point was that even though they use usernames, they still allow you to simply login by using their e-mail address. That's a lot better than sites having a 'lost your username?' link IMHO.

We need the username in order to say who edited what.

How about using the email address instead (and offer a username as a display alias only, if people don't want to have their email address displayed).

Meh -- who would want their email address displayed? That's not a safe default. You'd just be punishing the users who don't manage to find the setting.