I just saw a post on the site by a user with the username "gmail.com". There is also an active user "yahoo.com". Is this not a potential security threat for some cross-site scripting scenario?
https://firebounty.com/bug-bounty-program/302/stack-exchange says to take any suspected problem to https://meta.stackexchange.com/contact and to NOT answer @AndrewT.
If there is a real issue report it, if you want to know what issues having weird usernames can cause and how to mitigate them in general take it to security.se.