Private packages use an @ sign at the beginning of the slug to indicate a private package. Usernames that are essentially emails break this functionality.

Extend the username validation parameters to not allow special characters like @ signs.