I would separate the directory creation from the CGI completely. There are a couple of approaches.

• Create a script that runs every minute or five minutes from cron. Have it check a directory for files containing username. If found, create the appropriate directories. Have your CGI script save the user name to a file in this directory and exit.
• Create a daemon process, and have it listen on a socket or pipe for incoming data. Have the CGI script connect to the daemon and send the user name.
• Create a normal program and have it sleep. Write a pid somewhere, or grab it from the CGI script. Have the CGI script send a user-defined signal to the sleeper, which will then wake up, check for an entry in a database or a new file in a directory, and perform the updates.

In no case would I trust the CGI script with root access. The first option is my preference.