"username or password incorrect" does not imply that the username was correct or incorrect. The system is saying one or both fields are incorrect.

Read the proposed message a few comments up. It actually says "username & password do not match the records we have for username XXX", thus implying that username XXX is a valid username. "Username or password is incorrect" does not indicate whether the username is valid or not.