It's not broken; it's an intentional form of user validation.
Although in this case, not validating the emails client-side just means I have to validate emails after I receive them. Which is actually good in a way, I like seeing when people send stuff like "DROPTABLEuser" or "'SHOWPROCESSLIST'1=1", it's kind of a fun curiosity I suppose.