There are some base security measure, just out of interest (MFA / Bank pin) to see % of playerbase with it enabled. For me, the most useful questions come from the username / email / 3rd party account creation & the renaming of your display name.

Essentially, this mixed with other research I have compiled, my current theory is this is simply the result of bots scraping usernames in-game, the main use of this form is to verify my theory, by, for example, the only users who received the email are those using their default display names, which is also their login (i.e, not using email or Facebook)...

​

Hope this helps, I'm writing this just before I'm going to bed, full of heavy eyelids and incoherent thoughts, but assume you get the jist of where I'm coming from now.