Maybe is good to hide the username due to security reasons.

Furthermore, it would be nice to add numbers or a logical sequence to every email. This way we can ensure that even the possible hacker knows the exact username of a client, it won't be the same that exist in our database.

The password_confirmation validation only happens if password_confirmation field is sent by the client.

Maybe the expected bahaviour would be a Bad Request. Password_confirmation must be a required field.