I've seen quite a few security centric sites enforce this policy:
Your username can only be changed once
My question is: Is this done from a security standpoint? If yes, what is the logic behind it? My initial impression is that once you sign up your original username (and any other username you choose in the future) is linked to you indefinitely, even after you change it as allowing someone else to claim your (old) username could introduce some kind of security vulnerabilities. If a site allowed unlimited changes this could potentially reduce the pool of available usernames by a significant margin.
Is my analysis correct? If yes, what are some examples of security vulnerabilities created by allowing multiple changes?
Or am I barking up the wrong tree altogether?
I did read this discussion but the question revolves around whether username changes should be allowed at all. I'm specifically asking why some sites allow you to change your username but limit it to once over the lifetime of the account.