I think you are right. The original appearance of the code that is now in that clean_username method was quite a while ago, back in 2006:
http://code.djangoproject.com/browser/django/trunk/django/contrib/auth/forms.py?rev=3520#L8
When added, the check was part of a custom form manipulator. Manipulators were before my time but just from looking at it I get the impression there was no way to take the automatically created manipulator for a model and tweak it to only display a subset of the fields, add entry of two password fields instead of the one in the model, etc. So this form was added as a custom manipulator, and it needed to do the username unique validation itself since it wasn't building off of the basic add manipulator for the auth User object.
Then manipulators got replaced by newforms (which became forms) and model forms, and model forms did unique validation (eventually -- they may not have when this particular form was converted to newforms), and could be customized in ways the old manipulators could not, so this custom form's manual unique validation eventually became unnecessary. But nobody noticed...until now.
Karen