Most markdown implementations automatically escape otherwise problematic characters when they occur in code spans and code blocks. If we’re doing the username conversion after things arrive in HTML land, we probably need to make sure we’re excluding them from a similar set of elements — <code>, <pre>, possibly <textarea>, though wow, that one wouldn’t have occurred to me until today.