Can loadUserByUsername() be used with something other than a username, like an email or phone number?

Yes — the parameter name is just a String identifier; Spring Security doesn't care what business concept it represents. Many production systems pass an email address, employee ID, or phone number into this method; what matters is that your custom implementation correctly resolves that identifier to a unique user record.