It's addressed in the article. It's a valid concern, but they explain their decision - their "forgotten username" screen is a pretty simple way to check whether a username exists or not, so it's almost a moot point as far as security is concerned.