Don't allow the username to be changed on the login form, and make sure all input is entity-escaped.