The probability of finding a limited set of collisions for HMACSHA256
I think most would agree that 2^128 is not plausible without UFO space alien technology (i.e., wildly successful quantum computers).

There is no currently known way to find collisions over SHA-2-256 in any plausible amount of time, with any plausible number of inputs.

As long as the key is secret, there is no known way to someone to find a username or randomID that produces a target HMAC value, or to predict the HMAC value for one username+randomID given the value for another (length extension attack).

However, another thing to be concerned about is timing leaks if you ever compare an expected HMAC value and a value received by a potential attacker. If you use a naive strcmp(), timing will tell the attacker how many initial bytes he got right and he can use that to work out the value he needs to send without even knowing the key, username, or randomID.