> I am not sure what happens if two different joes: joe@somewhere.com
and
> joe@overthere.com both email the tracker.

You get joe and joe1 (assuming joe1 exists, otherwise joe2, 3 ....).

I checked and the user creation process triggers auditors, so adding an
auditor with

  db.user.audit('create', modify_numeric_usernames, priority=90)

should run modify_numeric_usernames before the tracker supplied user
auditors.

Similarly you can prevent setting the username to a pure number with a
set auditor.

Ralf, what are your thoughts on including something like this in the
default auditor?
By default it would add an alphabetic suffix (a,b,c,d...aa, ab...) to
any pure numeric
username. We can set a flag in detectors/config.ini to easily disable
the feature to allow
pure numeric usernames.