Particularly bad since there are more flexible ways of creating usernames that can prevent collisions or unfortunate combinations.

In particular, firstname.lastname, with the addition of middle name first-letters if they exist. Sure, you can still get name collisions, but this method gives you a level of flexibility and professionalism that OP’s does not.

You can even partition people by function or position by using subdomains. So in this case, it could have been megan.finger@student.cwu.edu such that they never are confused for anything other than a student.

Or maybe by campus. Or a combination of @position.campus.city.institution.edu, especially if we are looking at an institution with tens of thousands of students in multiple locations across multiple cities.