My vision insurance company (in the US) is awful about this. They use emails as usernames and when you log in, there's an option to change the email or password

My vision insurance company (in the US) is awful about this. They use emails as usernames and when you log in, there's an option to change the email or password. The problem is if you change the email, it only updates where notifications go. The username is still the old email and that's where things like password reset emails are sent. (And they don't support 2FA. Better keep the old email around indefinitely...)