In response to BLUE COW:
The quick answer to you question is 'either'. You can do it in a Validator or the controller.
If you don't want to create a validator, then override the onBindAndValidate method of BaseCommandController.
Simply do your check there (via your DAO) and call reject on the BindException if the username is bad.
Mike:
I recommend the same to you. Do your check for badUsername in onBindAndValidate and if you do add an error then SimpleFormController will automatically display your formView for you. You could also blank out the email and password fields at that point, instead of in referenceData.