I asked somebody who used to work there, and the answer I got was that there are a bunch of accounts from back before validation was as tight as it is now.

Which seems reasonable to me. At-replies were not something that Twitter started with, but instead were community-driven with software support added later:

https://blog.twitter.com/official/en_us/a/2008/how-replies-w...

It's a good reminder that it's always easier to relax restrictions than to tighten them.

But then again, if Twitter early on were run by the sort of people who were inclined to lock down everything, it might not have evolved enough to be really useful to people. I hazily remember the Friendster guy getting really mad that people were creating accounts for non-human things that they loved, like cities and bars and companies. I think he went on a banning spree. Instead of saying, "Look how much people love my platform! Let me support them in their efforts."

Possibly a difference in implementation of unicode between validation and persistence/use. Validates successfully due to one or more "valid" unicode characters -> translated to zero characters due to stripping of invalid unicode character at some point after validation.

Hard to say without knowing the code, but one common problem is to do something like length checking a username to ensure it is a certain length, and then later stripping out illegal characters.

MVP mania perhaps? You know, the old chestnut about "You have to get the shoddiest, most ethereal, stuck together with sticky tape and chewing gum version of your app out there to get market validation before you do some serious development work on it" ideology that is always being touted in the startup world... It tends to lead to this sort of technical debt.

Regex gone bad?