I have a nice anecdote to share. Years ago I was in the dev team for the website of a new major mobile operator in Italy. When the first version went to production, there was a wave of sign ups from customers, but in the following days we received a lot of support calls from customers who had signed up but couldn't access their accounts. We started analyzing the problem and noticed two things:

1) the customers who couldn't sign up had used illegal characters in their usernames - there was no validation in place to prevent this: bad mistake;

2) most of these customers, literally hundreds of them, had signed up with usernames containing lots of asterisks. Many usernames looked like lillo* * * * * or bobby* * * * *.

I didn't give much weight to this, assuming (wrongly) that it was just a coincidence. Only a guy in my team kept thinking there had to be an explanation, until he nailed it: it was the signup form that said "fill in the fields with asterisk". So we added the damn validation and clarified the copy.