On the length of account names, nothing I have noticed. I have a mix of affected and unaffected accounts with similar length, and one affected account that is just four characters.
The way the test script works, is that handles the Oauth2 authentication at the start of the script - and after that, the connection is open/authenticated and it is just sending a series of IMAP commands interactively with the server.
If you look below, this is the Microsoft script running against one of my affected accounts - but in this case, I commented out the last line which does a CLOSE on the IMAP session, and that leaves the session open for me to send my own commands to the server. The two commands with the green arrows are ones I have just shoved in and you can see the LSUB command fails as it did in the script.
So I don't think this is going to be related to authentication.
