I'm not sure how the user names were exposed. You should get an error if you try to access them as an outside user:

{"code":"rest_user_cannot_view","message":"Sorry, you are not allowed to list users.","data":{"status":401}}

Mike