No, that guy really just doesn't know what his address is. There is no fname.mlastname@ account. You can verify that very easily by sending an email to that add

No, that guy really just doesn't know what his address is. There is no fname.mlastname@ account. You can verify that very easily by sending an email to that address. 100% of the time it will arrive into your account. Or you can try logging into it with your password. In Google's account system, there's ~nothing you can do with just the username. You need a user id. The only way you can get a user id from a username is to call an RPC service to do the lookup. Doesn't matter whether it's for logging in, finding the account to deliver email to, creating an account, or whatever. Everything goes through that chokepoint. And that RPC server will always normalize the username at lookup time. (I probably read that normalization code more often than anyone when working at Google on account security stuff, since that was the single place that had any reason to deal with usernames rather than user ids. That code was effectively immutable.)