I have a crazy idea: Why not let the user decide and check off what alias (if he/she chooses any) can be used to log in in addition to the primary address? I'm sure some people would like to give out something like
firstname.lastname@outlook.com, but log in to the account with a really crazy account name that isn't common. I mean, I had a common one that got that message "too many attempts" or "locked" when I accidentally misspelled my password. Then I made it an aliases under a secret one for logging in only and that crap stopped.
I think it's a step back in security. I wish Yahoo and Google would let you make an address and lock it in for logging in only and lock the others out for signing in.