Constituent Login Creation and Maintenance

Hello all,

I'm hoping to get a sense of how others manage the Logins of their constituents.

Do you always create a login with the email address when you create a new account?

Do you always update the login when a customer updates their email address?

I have been thinking about this because we have recently had some customer confusion when they try to generate a new password over the web, but fail because they never had a login created. 

I would love to know about any magic bullet that creates the login based on the email, and updates the login when the email is updated :)

Best,

Nicholas Hudson-Ellis