Also I'm not sure what functionality the authentication cache provides, but their use of bcrypt(userId + username + password) implies the password is kept around somewhere, which is not the best practice.
OT. Has Argon2 basically overtaken Bcrypt in password hashing in recent years?
That depends on how exactly it was used. If it was simply used to check if previous authentication was successful (without the value containing information who it was successful for) then single long password could be used to authenticate as anyone.
Only if everyone uses the same long prefix for password.
bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true
If they then try login as you@bar.com using same password there would be a cache lookup:
bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true