The easiest way would to use a coa for it:
MAIN.10 = COA
MAIN.10 {
10 = TEXT
10.value = <iframe src="http://example.com/index.php?user=
20 = TEXT
20.data = TSFE:fe_user|user|username
30 = TEXT
30.value = &email=
40 = TEXT
40.data = TSFE:fe_user|user|email
50 = TEXT
50.value = "></iframe>
}
You can of course use more sophisticated stdWrap constructs, but this is also quite readable.
Keep in mind that performing actions based on username and e-mail is a possible security issue. At least someone could expose users of your service if they guess both values correctly.