Reply to post:

Another policy which at first glance makes sense is:

You cannot use the part before the @ in your password.

But what if you've registered your super cool domain name and have a single character before the @ eh Microsoft?