I found two other places:
The mentions notifications use only the username even when prefer username is unset/names enabled.
And the Who’s Online hover title on the listed avatars is the username as well, even when the hover on avatars elsewhere (such as latest topics list) is the name.