Regarding point 1, my favourite solution to the problem of users forgetting the account name is to use the email address to log in, rather than forcing the user to make up an account name. Are there any reasons for not doing that?
I have my own mailserver and add a different random number to my email address each time I give out my email, so if I get spammed I can blackhole that address, determine the responsible party and complain to them.
If a site makes me login with an email address, I usually have to copy-paste the address because I don't have the patience to memorize dozens of random numbers, many of which I rarely use.
