Well we found one reason anyway – it looks like you can bring up a list of authors using ?author=1 query, which I hadn’t even known existed. Here’s an article that explains how and how to fix it:
https://www.wp-tweaks.com/hackers-can-find-your-wordpress-username/