My login settings show only email address as Authentication Type (see image below)

 

I am still getting an alert as follows - 

Display name logins are enabled
Allowing users to log in with a display name can represent a security weakness for your community because display names are public information and malicious users may attempt to login to multiple accounts with common passwords until they find an account for which the passwords work. It is recommended that you only allow users to log in with their email address.

Am I missing something? 

 

 

Do you have any login methods defined other than the standard one you posted in that screenshot?

If you did a conversion, check the converter login method, which is linked to this