I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about usernames. For example, in most registration flows, when selecting a username, the system will tell the user whether a username is taken - thus potentially giving malicious users a list of valid usernames. And that's okay, the same things happen in most password recovery flows.
A suggested flow for a user that is trying to recover their forgotten username would be to allow them to type in their phone or email, and the system would instantly return their username in the UI without verification.
The main problem that I could see is that this may allow a malicious user to not only obtain the username, but also to associate it with phone/email. Maybe that's okay too though, because that doesn't give any vital information. To access an account, they would still need access to that phone or email to reset the password. In that respect I don't believe the account would be compromised.
Help me out, what are the flaws in my thinking here?