Which type of user is that?

When a user creates a session with an email, for example:
email: 2@email.com
In account prefs permission will be
"$permissions":
[
"read("user:2")",
"update("user:2")",
]

But I saw something like that

"$permissions":
[
"read("user:656d6a52734d436a3cf8")",
"update("user:656d6a52734d436a3cf8")",
"delete("user:656d6a52734d436a3cf8")"
]

How is this user created? Is it through API?

Where are you trying to set permissions at or trying to achieve?

My friend sent me that can you ask about that on the appwrite discord server because discord is banned in their country. In their appwrite project someone created a user with that username without permission. And he wants to know how that is created and how to prevent