If someone has no email listed on their github or twitter and doesn’t have open DMs but you need to contact them privately for whatever reason (eg a security issue in a repo they control).

GitHub doesn’t have private messaging.

There are tons of legitimate uses. The point of a username is to identify someone.