> those that say “wrong username” means that the password is valid How could it mean that? The only reason you'd ever say "wrong username" is if the account doesn't exist (otherwise it's indistinguishable from "wrong password") and in that case there's no reason to even look at the password.