There's a reason this is not allowed: an attacker could log you out of your site :) If someone knows your username they could keep trying to log into your site with it and with the same obviously wrong password, triggering this feature. This would block your user account, essentially locking you out of your site. The user registration is required so that Joomla can send you a user account activation link which you can use to re-enable your user account.
Frankly, if you have user registration turned off you are better off NOT using this feature. It is for a completely different use case than yours. What I would recommend is turning on MFA in Joomla itself – this used to be a separate product of ours (Akeeba LoginGuard) before I contributed it into Joomla itself a few years ago.
The next version of Admin Tools also has an interesting feature which treats logins to "forbidden" usernames (commonly used for credentials stuffing) as blocked requests. This would work wonders in what I assume is the problem you are trying to solve: lots of requests trying to guess login information to your site.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
