Use a lookup:
index=abc EventID=4625 [ |inputlookup users.csv | table username] | ...
You could manually manage your lookup or update it using a scheduled search and outputlookup command.
You have only to put attention to the name of the lookup column (username): must be the same of your search field (username), otherwise rename it in subsearch.
if the search to generate the lookup isn't too slow, you could also use a subsearch:
index=abc EventID=4625 [ search index=myindex | dedup username | table username]
The documentation at Define search macros in Settings
-- 7.(Optional) Provide Arguments as appropriate for your search macro. This is a comma-delimited string of argument names without repeated elements. Argument names may only contain alphanumeric characters (a-Z, A-Z, 0-9), underscores, and dashes.
index=abc EventID=4625 username=$arg1$ looks fine or
index=abc EventID=4625 username="$arg1$", with double quotes.
The search itself behaves like a regular search which means that the default operator is AND. If you want OR you should place explicit OR in the search query, such as -
index=abc EventID=4625 OR username="$arg1$"