Should this be served_user, not aor?  In the case where this is called from the main registrar aor will be an empty string on entry to this function and I can't see anywhere it gets changed.

I'd be interested to know how this has been passing our unit tests, as far as I can see we would set a blank aor in the third-party registers we send.