As I said above, I had earlier asked Atlassian to look into it. They were not able to consistently reproduce the problem. https://hibernate.atlassian.net/browse/WEBSITE-165?focusedCommentId=59348&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-59348

It was left at the next time it happens to leave the user alone and send the names to them to investigate. Apparently though you already "fixed" them. Next time we need to let Atlassian look first.

TBH, I have no idea what the right group is. They royal fucked up the permissions during one of the upgrades imo. There are now multiple "same sounding" groups and no clear cut documentation as to which we need.