Earlier quoted context omitted.
Here is my personal experience with some of that "poorly written" code: http://www.postlibertarian.com/2013/10/yes-the-obamacare-web... > the text on the sign-up page, the front-end javascript validation on the sign-up page, and the text on the help page all have different requirements for valid usernames in the database!
That sounds like poor BA/spec work. BA asks: "what do we need from this username". BA should ask "what do we need from usernames overall"? It's always going to be hard to be agile on federal contracts - there're too many customers to really get a clear view from them.
[0]http://www.bloomberg.com/news/2013-10-02/untangling-obamacar...