Re "Two", if you choose an email address that doesn't look like an email address and it gets blocked then I'm not sure that it is the developer [alone] who is being stupid.
I'm not talking about escaped @ symbols here (that's bonkers). There is still plenty of code out there that assumes a domain suffix is only ever 2 or 3 letters long and that usernames are only letters and numbers.
