If you turn off special characters in display names in the control panel, then it prevents username spoofing. Strips out everything that isn't a alphanumeric characters, allows for _ however.