usernames should be created in a type-safe fashion that includes the full e-mail address.

I always run this before using a user-entered string:
/**
* Replace any potentially unsafe file system characters with "_".
*
* @param filenameNoPath A potential filename (without the drive and/or path)
*/
public static String forceSafeFilename(String filenameNoPath) {
try {
filenameNoPath = filenameNoPath.replaceAll("\\*", "%47"); // * is safe for URLS, but not for file names
return java.net.URLEncoder.encode(filenameNoPath,"UTF-8");
} catch (Exception e){
throw new RuntimeException("UTF-8 not supported!");
}
}