We only include the username, not the (optional) real name. If I had thought about it before now, I’d have said that sounds suboptimal. But now, I guess it was smart ;)
email: some@real.address
username: F*YOU
submit!
Now your sending "Hey F*YOU!" to real people.
I think you can't restrict usernames enough to not allow any spam. The only right way is to really just have the email and nothing else in the first confirmation mail.