The only illegal characters in a username are ":" (field separator), "\n" (line separator), and "/" (filename separator). Restricting usernames to the legacy posix character allowed set (for filenames, so the $HOME directory is creatable on VFAT and similar) means you can't have UTF-8 usernames. Linux allows any character but / and NUL in filenames. Since root is creating these entries, we assume root knows what it's doing.

--- a/lib/pending.h	Fri Sep 26 18:42:23 2014 -0500
+++ b/lib/pending.h	Fri Sep 26 18:49:44 2014 -0500
@@ -2,6 +2,5 @@
 
 // password.c
 #define MAX_SALT_LEN  20 //3 for id, 16 for key, 1 for '\0'
-void is_valid_username(const char *name);
 int read_password(char * buff, int buflen, char* mesg);
 int update_password(char *filename, char* username, char* encrypted);