We ended up deciding to deal with the appearance of $user1 in the alarm messages. It is a very lame problem, but we did not bother opening a support case. We needed a quick solution, and support gives us too much of a runaround with nearly every case we open.
So we created the following pre-processing script:
event.message = string.gsub(event.message, "='$%w+'", "=''")
return event
This script removes other variables that suffer from the same issue. Note that we are using ='$var' in the probe for those variable, so the regex can match them with some extra context--not necessary but a nice safety net. The pre-processing rule matches interface_traffic alarms with the following regex for the message, which once again is somewhat specific to our alarm message format:
/='\$/