So, the user list would have to be available/harvestable?  I guess this is an argument for having separate login Ids and published usernames.  So, one couldn't just spider a site to create a user list.