See this comment in config-dist.php:
// Restrict certain usernames from doing things that may mess up a site
// This is especially useful for demonstration teacher accounts
// $CFG->restrictusers = 'teacher,fred,jim';
and the functions check_for_restricted_user() and is_restricted_user() in moodlelib.php.
Can this nastiness be removed as part of the roles and permissions work?
There are only two calls to is_restricted_user, and 11 calls to check_for_restricted_user in the codebase,