The "Disallow usernames" feature is case sensitive, i.e. adding "phpbb" as a disallowed username still allows a user to register as "phpBB". Whatever check is being done against the disallowed list needs to be changed to be a case insensitive comparison.