The allowed characters in the username part of an e-mail address are also enumerated in the updated RFC 2822, section 3.2.4. It's strange that so many validators get it wrong, when the specification is so clear...
XMPP does use the same (or similar?) stringprep profile as email. More details are here. I'm on the phone or I'd look deeper into the RFCs but I think this would be a bug on our part.
Hal Rottenberg
Webmaster, Evangelist, Co-conspirator to the Revolution