FLTK uses the @ character for formatting so we need to make sure we escape any @ before giving it to FLTK. E.g. the string "user@server password:" is rendered as "user" because fltk chokes on the @.
Also noticed this whilst testing bug 4003 as the username there contained @.
This happened again on bug 7764 where OpenSSH was adding some new prefixes with @ in them.