> Here's the finger client. The ampersand expansion is done client-side
> instead of server-side for some reason:
> <https://github.com/freebsd/freebsd/blob/1d6e4247415d264485ee94b59fdbc12e0c566fd0/usr.bin/finger/util.c#L67>

> it doesn't seem to matter whether we expand ampersands in those fields

Bingo. Same FreeBSD finger client:
<https://github.com/freebsd/freebsd/blob/1d6e4247415d264485ee94b59fdbc12e0c566fd0/usr.bin/finger/util.c#L343>

OpenBSD finger client:
<https://github.com/openbsd/src/blob/515e489c3d599b9cfcdf9cf6842ac49f92e154d6/usr.bin/finger/util.c#L101>

It's the userinfo() function. Ampersands are only expanded in the first
subfield.

And the first letter of the username is capitalized (toupper()) but the
remaining ones are not.

Sendmail has a compile-time option to convert fullnames from Latin1. I
suppose we can assume UTF-8 nowadays (knock on wood).