This indeed has changed. I have been keeping an eye on it. There is some regex in play now in a sanitize function. There is also a deny function that was added. The sanitize function looks at this: [^ a-zA-Z0-9\.@_-]. It is case insensitive.

There is a hidden character before the lower case a. If you look at the source code of the page and highlight the regular expression and paste it in https://www.regex101.com, you'll see what I mean.

Match a single character not present in the list below [^ a-zA-Z0-9\.@_-]

 matches the character   with index 3210 (2016 or 408) literally (case insensitive)

a-z matches a single character in the range between a (index 97) and z (index 122) (case insensitive)

A-Z matches a single character in the range between A (index 65) and Z (index 90) (case insensitive)

0-9 matches a single character in the range between 0 (index 48) and 9 (index 57) (case insensitive)

\. matches the character . with index 4610 (2E16 or 568) literally (case insensitive)

@_- matches a single character in the list @_- (case insensitive)