It is important to remember that in some environments, restricting a username may also lead to it's own security risk.
When bruteforcing a web application login, where no usernames or passwords are known, it often makes more sense to take a number of common passwords and attempt to guess usernames. The theory is that given X number of users of a web application, it is more than likely that a number of those users will have week passwords. This kind of bruteforce also helps to get around password lockout policies.
Now of course there is a trade off between security and usability, the last thing that you want if to allow every character and find that most of your time is spent answering customer support requests for lost usernames, but when considering restrictions, I find it best to be as unrestrictive as possible.