Certain account names like "security", "info", "admins", etc. shouldn't be registrable to avoid confusion. (That said, security has already been registered, by me as a sysadmin, to facilitate creation of the security-discuss mailing list. But sysadmins ought to be trusted not to misuse the name for other things, like posing security@ as a security contact address for the SRCF...)
Given that group account creation is subject to manual review, there is already a layer of prevention that should stop such names being taken. It would be better if the set of "reserved" account names is programmatically enforced by our systems, though.