Prevent forwards using same username+domain as users.

Validation only looked for forwards, now also users.