That makes sense. Since md5 can have collisions, is it also safe to assume that the cracked username is not guaranteed to be 100% accurate? In reading about it

That makes sense. Since md5 can have collisions, is it also safe to assume that the cracked username is not guaranteed to be 100% accurate? In reading about it some more (particularly the md5 collision demo based on Patrick Stach's implementation), it looks like it would be trivial to create an md5 hash that resolved to a "fake" username while the real username remained uncracked. Although that would mean that both the fake username and the real one would be exempt from the exploit, so there would really be no point to it.