Seems like you might not want to do it if they enter a correct existing username/password, otherwise there is the slim (but non-zero) chance that they'll fluke

Seems like you might not want to do it if they enter a correct existing username/password, otherwise there is the slim (but non-zero) chance that they'll fluke into an account that isn't theirs. I figure email would be a better "username" since they aren't likely to enter the same one. I don't know if you've encountered that problem (rare, I know).