Doing it by username means the real user can lose access to their account, whilst it is being attacked, even though they might have strong password.