Another problem that may arise when using the email as username is "user harvesting" attack.
For example, if you have a "change email" page or when creating new user, if the new user insert an email which is already exist then the application will have to send back an error. Consequently, an attacker can discover all the users in the application by executing a simple script (in case the user doesn't exist it will be added )
