I created an auditor in my tracker. Recording the details here in case
they are useful before we get the core fixed:

in existing userauditor.py added:

valid_username = re.compile('^[a-z0-9_@!%.-]+$', re.IGNORECASE)

at the top of the file.

Added to audit_user_fields:

    if 'username' in newvalues:
        if not valid_username.match(newvalues['username']):
            raise ValueError, "Username/Login Name must consist only of
the letters a-z (any case), digits 0-9 and the symbols: @._-!%"invalid
"%s"'%address


This should allow email addresses as usernames.