Pretty much every website I know does the same.
Account security relies on password, not the user name. This password should be kept secret and secure.
If it is, it doesn't matter who knows the user names.
If it doesn't, deal with it, because it's the primary issue: hiding user names won't help.
Note that relying on the fact that the web application doesn't display the user name is problematic for a few more reasons:
If the database is hacked, the hacker has the names of every user. While you can (and should) avoid storing users' passwords anywhere on the servers, you may not be able to do the same with user names. For example, storing only the hash of the e-mail makes it impossible to contact the person later by e-mail.
With a bit of social engineering, it's easy to determine what is the user name or the e-mail address which is used to access the web application. Let's take an example. You want to know what do I use to log in to Stack Exchange. From my profile, you get my real name. A quick Google search for it reveals my Google+ profile with my personal e-mail address, as well as my full profile on the website of my company as the first search result, this second profile containing my business e-mail address. This gives you two potential addresses.
From Gravatar, you learn that the MD5 hash of my e-mail address is
Surprisingly, two e-mail addresses you've previously found have different hashes:
Let's see what additional information we can get. We can:
Either explore my profile on my company's website in order to find a screenshot of Password Manager, an app I developed. This screenshot displays two e-mail addresses: my personal one, already found through Google+, and a new one. A quick MD5 test reveals that it matches.
Or look at Google results for my first and last name and notice that they mention lakaidreams.com. A whois search shows not only that I'm the owner of the domain, but also reveals the very same e-mail address.
As you see, if Stack Exchange was relying on the secrecy of my e-mail address to prevent unauthorized access to my account, you couldn't be sure if the person who is typing this answer is really me.