Symptoms

I have a simple workflow that sends a User Task and Notification with that to an individual that is not the originator. The step before this User Task is a Get User action to use an email passed in to retrieve the User _ value for Participant usage. When the passed in value is left blank the User Task still went ahead and sent a Task and Email but to random users. This probably should have not executed at all and more so not to random users.
 

Diagnoses

The reason random users are being returned is because when all fields in the Get User Reference event are blank, a Get List method is fired behind the scenes with no values to filter the results by, so all users are returned. This is expected by design, but admittedly could be handled a lot better.
 

Resolution

A quick workaround would be to set the default value of your data field to a space character " ".