So each user effectively gets assigned one of ~1000 ids, which is not that different to a three digit decimal PIN, that they then can use as password?
It seems to use it as an authentication scheme a username and 2FA/MFA is _mandatory_. I guess one could then also say: a username is a very strong and efficient authentication method.