Briefly it was username only, but after a few days the number route was re-enabled. But your fundamental point is correct, that due to a data leak BA asked many people to reset their passwords, and of course the IT couldn't handle everyone changing their passwords all at once. I continue to use my number, but anyone who hasn't logged in for a few years may well have an expired password - it would say that on the screen - and should go through the re-set.