Improper user validation on mentions and hashtags