What, according to you, are the necessary activities that a penetration tester needs to perform while conducting a penetration test to discover valid usernames?