You want to use a value which will never change, so you don’t use anything the user provides at all. When a user creates an account, that account is assigned a unique identifying value by the application. This is how objects are identified in Active Directory, for example: each user, computer, group, etc. gets a Security Identifier (SID). That SID never changes, and the value is never repeated for any other object ever, even if the original object is deleted. Every other property of the object can be changed.

Basically, the key value to say “this account is this account” should never ever have any other purpose.