What happens when there are more than two users?
When the user does not supply the username and/or email, what do you want the system to do? Once you answer that question, you can implement that as logic in an if statement to avoid creating the user in that case. You can also look into using a model form.
Another thing to keep in mind is what do you want to happen when there is a valid duplicate user being sent across? Should it error, update the user or ignore the data in the request?