What's stopping someone malicious from entering my username in a random account on a random site? I see I can block it, but what if I actually want to use the site with my real account?

Seems like you should use a random token, or something slightly more secure.

Alternatively, make it even easier for users by using the email address they used to sign up for the service, like Gravatar for notifications. The user usually has to verify the email address anyway.

edit: ah, I see that it asks for confirmation