i encoutered a "bug" (not really a bug as stock virtualmin works but read on) in virtualmin when it create a user with a part of a domain. The bug was triggered by creating a virtualhost with the name:
On this creation virtualmin created an ftp user named '2014'. This made several issue where the system was confused and thinked that this was an UID and not a real user name. I think for a safety reason virtualmin should never try the creation of a full numeric user.
the first RFC 1035 state that a domaine MUST start with a letter but there si 26+ RFC that modify it and i am not sure that some RFC changed that latter on. If this is still the case the system should forbid it but for compatibility i sugest that only the 'full numeric username' case should be prevented (do not even try to tell php fpm that the user is 2014 for exemple as it will search the uid 2014 not the name).
best regards, Ghislain.