Re: many packages write to `temporary-file-directory' insecurely

[Richard Stallman]

    On the other hand, I've realized it's a good idea to put the actual
    username (or at least the uid) into the score lines, so if someone is
    using it to store a substantial amount of data, then it will be
    blatantly obvious who is doing it.

yes.  With the uid, it doesn't need any other name info.
Beyond that, there could be a limit of 1k bytes per user.