Usernames are not necessarilly personally identifying, and are freely given by the user to be publicly displayed on a forum. Passwords are not personnally indentifying, and you shouldn't be storing them anyway!
Literally the only purpose of usernames is identifying people.
I don't know the actual text of the GDPR, so I don't know the definition of "personally identifying", but I find it very strange that people seem to restrict the definition of "personally identifying" to "connects directly to your IRL identity".
Personal data is both PII and any information which could be used to identify someone when combined with other information. As you suggest, a username is likely to be personal data because in lots of cases it is used as a unique ID and is used by the same person across multiple sites to identify them.