Reason for this is that the plugin is reliant on UUIDs, however for illegal playernames it still queries mojang's database through the Bukkit.getOfflinePlayer(name) method, since that queries the internet it is terribly inefficent for something we know won't get us far. Illegal playernnames are used by plugins such as Towny and are used as an alternative to Banks. These can also be spotted pretty easily as they include illegal characters such as -, $, / or others.
Fixing it would be a significant feat since it would need to be converted in one way or another, however this conversion would be pretty hard as we cannot reconstruct the playername of a UUID.