You don't have to be arrogant to feel superior to this bug. There's no way that this is some inadvertent emergent effect of complex mechanisms reacting to each other. Somebody wrote code that in some context searches username strings for the substring "user." Even worse, under many circumstances when it finds one, it just shits itself probably looking to check that user against something it can't find, then looks for again, but can't find, then looks for again...
The fact that it's obsessing you to figure out what kind of thought process could originate code that produces an interaction that expresses itself in this way IMO means that you'll probably never write code like this. Magic words, magic numbers...
All we know is that it triggers on the string "user"; could be that it CRCs to "00000000" or some other magic value, which then actually triggers the bug - and that there are other strings that could do this. (Which doesn't make your explanation implausible - per Occam's razor, yours would require fewer extra entities, and thus looks more likely - just that we don't know for sure)
The fact that it's obsessing you to figure out what kind of thought process could originate code that produces an interaction that expresses itself in this way IMO means that you'll probably never write code like this. Magic words, magic numbers...