Use user method rather than hardcoding unusable password
Use user.set_unusable_password() for setting unusable password
Simplify email address matching

We don't have to be perfect, just strip anything what looks like an
email address.