There used to be periods when you could use a username, or even an email address. Both were disabled many years ago for "security reasons" (likely the classic issue of people using the same username/email + password on multiple sites, not an actual UA security issue)