I wish there was a name for this kind of thing, because I see it a lot. Something is used a username in one context, then a password/authentication token in another.
(Ex: many libraries use your barcode number as your username)
I suspect the mistake stems from not understanding how passwords are stored.
(Eg: while yes, well set up systems hash passwords, usernames or any other identifier paired w the password are in cleartext, and in many cases huge swathes of the userbase can access them)
A bit late, but in my high school, we realized that our student IDs were chunked by which feeder middle school we came from. This was after we scraped the entire ID->Name mapping database.
For example, 7500-7600 was Middle School "A"; 7600-7700 was Middle School "B" and so forth. Within those chunks, we couldn't really discern an order, alphabetical or otherwise.
(Or they were sequential with blocks for each class)