Thanks for the reply and all the good tips. I will definitely follow your recommendation.
Are you sure this is right? If you are correct this seems to be a massive failure for sfGuard. Registration is case-sensitive, but the login is not case-sensitive.
Here is an example.
1. I register the user "Myuser"
2. Immedately after, I login successfully with the username: myuser
Holy crap this is the same for emails as well.. according to sfguard firstname.lastname@example.org
is not the same email as A@b.com
which is definitely wrong. I have no idea how this has slipped through the cracks until now?!