Zappos hack shows risk of using e-mail as your account username