Implementation of warning storage
The only criticism with the code is that your business rules are implemented in the third-party class UserRuleManager. This is OK if you are developing a a "rule system", but otherwise you should encapsulate the rules within the user class if they are about a user; the user factory if they are about how to create users; and the user repository (or data access class) if they are about how to persist and retrieve user objects.

Also, be wary if your class ends with "Manager"; it signals that the class will be responsible of too many things -- a God class.