digitalpoint may very well have a user with a comma as he was on vBulletin forever.
The only solutions here as far as I can see are:
Change the delimiting character used in the explode function in the controller.
Change the username.
Do something with jQuery so that the selected user IDs are passed to a hidden input and modify the controller to get the users from that rather than the usernames.