i think calling it a ‘security flaw’ is going abit overboard… most of the top 100 websites on alexa’s topsites list have your login name displayed publicly. (eg. if i gave you my gmail address so we could keep in contact, all you need to do is figure out/guess my password and hack my account.) but anyways,
Correct me if i misread what your saying, but it sounds like this might be the problem your experiencing – https://buddypress.trac.wordpress.org/ticket/3725 (it’s being fixed in buddypress 1.6)
