Based on these results it seems that the delete and update are being filtered by the email address and that this address has the @ encoded as %40. Where are you setting this value originally? I think if you had this value referenced with the regular @ it would work for you. One way you can do this in php is to use the raw url decode function, it looks like this:
rawurldecode(<you user email value>)
This should transform the %40 into the @ for you.