I feel like I’m posting a spoiler here, but... Think what happens if the user’s “e-mail address” happens to start with:

    "/><script>

Just put a script in the username field, sorry if that wasn't clear.

    <script>alert(0)</script>

All the live updating that module does, I figured there might be some code injection.