Theoretically, yes. RFC821 gives the spec for the local-part of the email address (before "@", not refering to quoted text) as:
any one of the 128 ASCII characters, but not any <special> or <SP>
<SP> = the space character (ASCII code 32)
<special> = "<" | ">" | "(" | ")" | "[" | "]" | "\" | "." | "," | ";" | ":" | "@" """ | the control characters (ASCII codes 0 through 31 inclusive and 127)
However, whether cPanel complies with the RFC is another matter. If you try it and it doesn't work, then it's not RFC compliant, but there's little you can do except raise a bugzilla report.