If you have other software installed on the client that uses similar mechanisms to intercept web traffic for filtering, the user request might be intercepted by this other software before MCP intercepts it. (Similar mechanisms to intercept web traffic for filtering can be security scanners, antivirus scanners, or categorization proxies.)

In this case, the username shown is one from the other software, which is typically System if the software runs as a Windows system service.

One known software product that causes this kind of issue is the tmproxy.exe application by TrendMicro. This application is known to be installed as part of the Trend Micro OfficeScan product.