You can register both second (example.name) and third (first.last.name) level .name domains. However, once a third level name is registered, they reserve the parent second level domain.

ICANN is involved because Verisign is the registry operator for .name, and the contract between ICANN and Verisign gives ICANN some oversight power over Verisign's registry services. This includes some fairly limited oversight power over what they call "voluntary services", which are services that the registry provides that are not required to be provided by the contract. Apparently the registration of 3rd level domains and the email forwarding service are voluntary services, not services that Verisign is obligated to offer by the contract.