This was a change that IPBoard made.. after upgrading one day, users were forced to login with display name. Not aware of any account compromises, if you have a decent password, you should be fine, and we block brute force attacks.
A bug is something which should be fixed it's a feature they changed so it's not a bug, feel free to post it yourself: https://invisioncommunity.com/forums/ They can explain why they changed from the first username you registered with (which you can see anyway).