Yes, that's exactly how it's set up - I'm not sure what went wrong with the person who called me last night, but when she changed the first character of her email address to lower-case, she was able to log in. Maybe that wasn't the issue at all, and it was something else.
I just tested it by capitalizing the first character of my email address and it logged me in successfully. I also changed the configuration to allow either username or email and then entered the username in all caps (it's lower-case in the record). That worked successfully, too.
So it seems that whatever she was doing on her phone, she was entering something else wrong - maybe a space, maybe a wrong password.
I'm just glad that I can step back from trying to troubleshoot something that isn't really an issue at all.
There were four other prior registrations that were not enabled and never confirmed. Those users seem to have tried again with a different email address - I'm not sure why.
Thank you,
Ernie