Let's imagine a website which allows users to Sign up and login only with their email address.
Is it possible to perform a second order SQL injection in that case?
It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.
So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.