Core system terms must be blocked universally. This includes admin, administrator, root, sudo, system, sysadmin, operator, and superuser. These terms suggest administrative access and are primary targets for social engineering. If @admin messages your users, they will assume it is official.
Web infrastructure terms create routing conflicts. Reserve www, ftp, mail, smtp, imap, pop, dns, ns1, ns2, cdn, api, static, assets, upload, download, and similar. Many platforms use subdomains like api.example.com or cdn.example.com — if someone registers "api" as a username, profile URLs like example.com/api conflict with your infrastructure.
Programming keywords cause database and code issues. null, undefined, true, false, nan, infinity, and void are reserved words in various programming languages. Usernames containing these values break naive string handling, cause SQL issues, and create edge cases throughout your codebase.
Test and development terms should be blocked too. test, testing, debug, demo, staging, dev, development, and beta are commonly used in internal systems. If these become real user accounts, they can interfere with QA processes and accidentally receive production communications.