Using an email address as a username is probably not the best idea: they are not constant. An email address is just that: an address. People move house and change their home address; they can change their email address far more easily!
Better to let the user choose a username (perhaps you could suggest valid available usernames from their real name?) and enter their password (twice if it's masked) and email address (once).
Tell the user to expect an email, and send an email to that address to validate it — that is, the user has to acknowledge it. It would be this validation which would trigger the human intervention to authorise the account. If necessary, the email address could be locked between validation and authorisation to stop the user changing a valid address to an invalid one.
If the email doesn't arrive, the user can log in to change their email address. Prior to the manual authorisation, this would be the only thing they could do with their account.
It would still be possible for the human authoriser to deny access to the system and remove the account to make the username available for someone else.