They don't just require username,it's for people who are getting hacked or someone is trying to hack them basically.
Jagex looks into who knows the most information and locks the account for saftey until the original owner submits an account recovery request.