Given the sheer number of arbitrary limits found in websites, I suspect your example is probably anecdotal.

It may have been as simple as someone piping something to a shell script to setup an account, and not escaping things correctly

This is precisely my point.