http_build_query() on your data-array first before passing it to
curl_setopt(), that will lead to it sending the form as
application/x-www-form-encoded instead of
multipart/form-data (and thus the @ is not interpreted).
Also why do you really care about the @ in an email-address? It only matters if the @ is the first character, not somewhere in the middle.