They should make the "order" irrelevant. ie silently retest using password/username reversed.

What are the chances that both (password,username) and (username,password) succeed? Very low I guess.

If it ever happens, reset password and send a mail about that (on both accounts).