I have learned that when a user unregisters or is deleted and then an account with the same username is created the first users profile information is inserted into the new user.  This is a big security risk because the same account name cannot be used twice otherwise the first users information will be displayed for the new user.  I am using DotNetNuke 5.4 stable.  Is this right and it has just been over looked or is my configuration wrong?

I am ready to deploy a website I made with DNN but this issue seems risky to me. I understand holding the information for data integrity purposes but I believe the e-mail for the new user should be checked to match the e-mail for the old user just to be sure nobody else will have access to that username. That means anybody could look through lets say a forum try different usernames that may have been deleted and register with their own e-mail and have control of an account linked to the previous user's information. I am reluctant to deploy my website till this is addressed.

Nevermind, the previous post did some more checking today after getting some sleep adn I must have not deleted the user that is why it was saying username already in use. On the other hand this is still a serious problem. No matter if all the IsDeleted flags are marked as true, a user can be created with the same name and the old information is subject to the new user. There needs to be some cross-checking of the IsDeleted flag. During registration if a username is trying to be created and that username already exists but the UsersPortal IsDeleted flag is marked as true, then that username should not be allowed to be created. Is anybody on board with what I am saying? It would not be a problem, if the information of the old user of that username was displayed for the new user. But, there cannot be duplicate usernames, so the only solution is that the new user cannot use a deleted users username. What can we do about this? I am not that good at writing code and interpreting it yet, but I believe this needs to be addressed because as of now it is unsafe to unregister or delete any users. I cannot believe this has not been addressed, user membership is like the holy grail of a website and without secure information, what is the point?