Using Umbraco events to enforce a specific user to only being allowed to create users but not update them

UserAdminCreateOnly.cs

using System.Threading;
using Umbraco.Core;
using Umbraco.Core.Models;
using Umbraco.Core.Services;
using Umbraco.Core.Security;

namespace Test
{
    public class MyStartup : ApplicationEventHandler
    {
        /// <summary>
        /// Bind to umbraco events when the application is ready
        /// </summary>
        /// <param name="umbracoApplication"></param>
        /// <param name="applicationContext"></param>
        protected override void ApplicationStarted(UmbracoApplicationBase umbracoApplication, ApplicationContext applicationContext)
        {
            UserService.SavingUser += UserService_SavingUser;
        }

        private void UserService_SavingUser(IUserService sender, Umbraco.Core.Events.SaveEventArgs<Umbraco.Core.Models.Membership.IUser> e)
        {
            //get the current user
            var backOfficeIdentity = Thread.CurrentPrincipal.Identity as UmbracoBackOfficeIdentity;
            if (backOfficeIdentity == null) return;

            //check if it's the 'special' user
            if (backOfficeIdentity.Username != "UserAdmin") return;

            foreach (var user in e.SavedEntities)
            {
                if (user.IsNewEntity() == false)
                {
                    //this user cannot save existing users so we need to cancel
                    e.Cancel = true;
                    return;
                }
            }
        }

    }
}