Maybe I'm missing something, but wouldn't the name have to have \n in it for the attack to work? This might have something to do with why you can't seem to delete the key. May I suggest you find it and dump it out readably like:

use Data::Dumper;
print Dumper grep /xung03/, keys %emails;
[download]

You really ought to make an attempt to see what's actually there before deleting it, or you won't be able to guarantee that whatever change you make would keep this from happening again.

Update: I see you seem to be dumping it in html. That will disguise the actual spacing. Try:

print "<pre>\n", Dumper(grep /xung03/, keys %emails), "\n</pre>\n";
[download]