Try this:
^(?!user|index\.cfm)([\w-]+)$
Note that this allows only usernames containing alphanumeric,
underscore, and/or hyphen.
If usernames allow more characters, or you want to defer validation to
the script, you could use something more inclusive (e.g ".+") instead
of "[\w-]+", for that part of the expression.
Oh and not too sure what the "user" part there is for, but it may need
updating if you don't want to block names such as "useredpaint" and
similar.
