Note: Not a duplicate of Name Change Limiting can be Broken, as the bug reported there is different; it has to do with account association, while this one is a completely different issue resulting in the same outcome.
After reading over the restrictions for username changes (paraphrased here):
- Can only change username once every 30 days
- Can change username within a 15-minute grace period of the last name change
- Accounts younger than two days old can change name freely
After some testing, I discovered a logic flaw in this algorithm. You get a 15-minute grace period every time you change your username. This includes username changes that were within the grace period of another change. This effectively means one can bypass the 30-day restriction by constantly changing one's username, making sure that each change is within 15 minutes of the last.
The ideal way to solve this problem would be to add in a "true" grace period (just like post edits), instead of simply checking to see if the last change was within 15 minutes. But that seems too technical, and I also see some good reasons for allowing for a new grace period for every change. However, users shouldn't be able to abusively bypass the limit. I can imagine a user writing a script to keep changing their username in the background, so as to allow them to manually change it whenever they please.
What's a good way to allow for this, but prevent users from abusing this loophole?