I guess I don't see how that would matter if the website were new. You still would have to obtain a username list prior to new users signing up (assuming they u

I guess I don't see how that would matter if the website were new. You still would have to obtain a username list prior to new users signing up (assuming they use the same password as the one you're trying) and even then you're also assuming the website doesn't detect the intrusion and advise users to change their passwords.