There are degrees of valid. There is RFC valid and then there is 'common sense' valid (there are degrees of common too). Forcing yourself into barely common valid but RFC valid is user's fault.
If the PM specifies a requirement to filter out email addresses with a single character before the @ sign, then that's a different thing. Maybe there is a business requirement to filter out people who own a domain and give themselves a single character email address? In that case it should be explicitly written into the validation logic and not done as a side effect of sloppy coding.