Any unicode character can be exploited onto the user's name

[sam (Sam Saffron)]

This is by design due to the default off site setting:

We disable this by default cause of this exact vector.

Oh … this is super nice: