bug x cross-site scripting on mail

[alejandroaguilarhiguera]

I wrote the tag with an image in the name of the team then invited a contact

[Azhariel]

Tried to reproduce this error bug now I have some questions.
I set the user's display name and the team name as long <img> tags, but they weren't compiled shown as images on the email. This does show the issue of long strings being permitted as display name and team name, but that's another issue.

This was my result:

So my questions are:

1. Did the image show on your test?
2. If it didn't, is this a security issue?
3. Should we disallow special characters for users and teams display names?
4. Should we implement a max length for those fields or just fix their display on the email?