On most sites it's difficult for a bad guy to discover the email addresses of your users (they're private). It's trivial to discover the usernames (they're public). With thousands (or millions) of users it's not hard for a bad guy to find accounts with weak passwords. Probably wise to make sure you have decent password constraints and a way of preventing brute-force logins.