I just saw a post on the site by a user with the username "gmail.com". There is also an active user "yahoo.com". Is this not a potential security threat for some cross-site scripting scenario?
https://firebounty.com/bug-bounty-program/302/stack-exchange says to take any suspected problem to https://meta.stackexchange.com/contact and to NOT answer @AndrewT.
If there is a real issue report it, if you want to know what issues having weird usernames can cause and how to mitigate them in general take it to security.se.
@is not a special character in the context of web applications (only email, which is quite different). It's characters such as
>, as well as some others that need to be dealt with for web security (and SE does that correctly). So this is not really an issue.