It's also a bit of a privacy risk to the users - if they use a publicly-known username (email address) with a very low-security password (e.g. 'password') acros

It's also a bit of a privacy risk to the users - if they use a publicly-known username (email address) with a very low-security password (e.g. 'password') across multiple sites, someone else could log in as them and e.g. track their activity on these sites.