I read everywhere (and see in practice) that usernames should not be changeable. When I ask why, \'security\' is given as a reason.
I\'ve been searching for a definitive
I'd say that not being able to change a name is BAD for security. Especially when the login is an email address. Steam is a perfect example of this... people signed up 5 years ago when they were in high school, with their finalfantazy7rocks@yahoo.com emails. Now they have to continue remembering that email, remembering both the Steam and email passwords, ensuring that no one has gotten access to the email, etc... even when they haven't used the email account in years. Basically it reduces the likelyhood that the login email is actually checked, which makes "forgotten password" emails and etc. less secure.
And you can't just make a new account if real-value items such as games are tied to that account. You're stuck with your name for life.