if the only flaw is that email is not coming when we requesting for username, then it is kinda sofware bug..not a security bug