I know this is often caused by enabling the root user, but checking the Directory Utility app — as instructed in other threads on this topic — has shown me that this user isn't at all enabled.
Only software I can think of that can be responsible for this is NoMachine which I use for remote access. But I just want to rule out malware at this point and figure how the hell can I get rid of this "user" (when I click on the its avatar I'm prompted to enter both a username and a password)