Hmm right I got your point. 

Does it make sense to have a different implementation of get_user for identifying the monitoring user's id? We never need to create users(even if auto_signup is enabled) in the Cc list in Mantis as it may also encroach their privacy(subscribing without permission).