I need to understand why change audit report reports an unused username
Name of the user who performed the change. This is the name entered when the user logged in. It can be the name under which the LMS application is running, or the name using which the change was performed on the device.
The User Name field may not always reflect the user name. The User Name is reflected only when:
A config change was performed using LMS.
A config change was performed outside of LMS, but the network has username-based AAA security model, wherein authentication is performed by an AAA server, which could be TACACS/RADIUS or local.