manage_user_create.php calls user_ensure_realname_valid() with $f_username, rather than $f_realname. This probably allows users created through the Manage Users section to be created with malformed real names - unless it is rechecked later in the user creation process.