Ok, full disclosure: I work for Gandi. We realize that motto is something you can't say on the radio, but it's so true, we just have to say it. We are a small, tough, smart company, the kind we want to work for. We do offer a full API for resellers, so you could white-box the solution if you wanted.
I work for Gandi in the US (full disclosure, here). We have been looking at this issue in particular lately.
There are a few ways we can beef up login security, but the bottom line is that it's a balance between that security and the inconvenience of lost login names. Many, many, people forget their logins, and this makes it easy to retrieve. This is more of a problem with accounts that you log into once a year or two, like registrars (Hint: use password storage software!).
That being said, we are actively working on a more convenient way to configure logins to provide security than this legacy method. I expect we will be addressing this in the next couple of months.
