cPanel prior to 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
cpanel cpanel