I think user expectation (from perspective of someone requesting a GDPR right-to-erasure from us) here would be that we do not store their username, as it might contain PII. Note that the scribbled out part on the right contains the username of the user prior to anonymization on a normal Discourse setup.