For those who have requested a username but never logged in, I advocate a quite short lifespace: Purge such usernames after 60 days or so, no confirmation e-mail required (the e-mail address likely doesn't work anyway).

For those who only used their username within 24 hours after creating it (so called "logged in once, never posted"), after 90 days, e-mail them stating that if they don't use their username in the next 90 days, then it will be deleted. Don't use e-mail replies to save an ID (that requires too much work to match up received e-mails to IDs).

If you've ever created a node, then you shouldn't ever lose your ID.

For the rest (used their ID a bit but never posted), we'll get around to those when things get too boring.