Ampersands (`&`) in messages, channel names, user names, and possibly elsewhere aren't currently escaped.