Oof, thanks. I forgot you could quote the @ and thought it was the one universally illegal character. Also forgot there were others, oops.

I usually just recommend people don't validate email addys and let the email verification message do the job for you. This is pretty much why.