Issue Board Bug | Users not in my project

I only have one person in my project (it’s me), and all repos and projects are private. I saw on my Issues Board this morning that two members, not part of my project or organization, can be assigned issues.

Is this a bug? If now, how do I remedy it?