They should make the "order" irrelevant. ie silently retest using password/username reversed. What are the chances that both (password,username) and (username,

They should make the "order" irrelevant. ie silently retest using password/username reversed. What are the chances that both (password,username) and (username,password) succeed? Very low I guess. If it ever happens, reset password and send a mail about that (on both accounts).