The support for mixing virtual users, with fully-qualified email addresses, and system users could be simpler. Assuming it doesn’t mess up other stuff in the code base, of course 😊.
You can define multiple passdb's not?
The problem appears to be that the PAM passwd module requires just user names without a domain
I am not even sure this is true, but the idea behind PAM (pluggable authentication module) you create your own or add any you like. Can't imagine there is nothing that takes an email address.
(which makes sense given that they’re system users) but does not, so far as I can see, support the username_format argument. In my setup, the default structure of 10-auth.conf demonstrates this:
auth_username_format = %n
So do not change it? Leave it as how people enter it.