tml_set_user_login()

function tml_set_user_login( $sanitized_user_login ) {
    // phpcs:disable WordPress.Security.NonceVerification.Missing -- mirrors WP core's own registration processing (register_new_user()), which has no nonce of its own.
    if ( tml_is_email_registration_type() && tml_is_post_request() ) {
        if ( isset( $_POST['user_login'] ) && sanitize_user( $_POST['user_login'] ) === $sanitized_user_login && isset( $_POST['user_email'] ) ) {
            $sanitized_user_login = sanitize_user( $_POST['user_email'] );
        }
    }
    // phpcs:enable WordPress.Security.NonceVerification.Missing
    return $sanitized_user_login;
}

View src/includes/functions.php, line 783 on GitHub