This was a change that IPBoard made.. after upgrading one day, users were forced to login with display name. Not aware of any account compromises, if you have a decent password, you should be fine, and we block brute force attacks.
We've decided to update this in CORE-2630 for v4.3.0 to have the event trigger after we've set the language, so in your case, you'll be able to override it.
I have to imagine others see this too:
A client has numerous addresses and they add them all and then they can't remember where to check for follow up emails or which one to use for signing in and they create their own confusion. I personally don't see the need for all of those addresses so it would be nice to control it a little bit and cut down on the live chats and support tickets about it.