could they not just have checked if a user exists with the canonical name?