OpenVPN remote user question

[XenonXZ]

Hi all.
I have set up OpenVPN remote access and all is well, everything works as expected.
I created a user, and assigned the cert to that user I created in the OpenVPN wizard, brill.
My question / concern is:

I then created a test user, no cert assigned to it.. I then did not export the opvn config for that user..I was able to auth as the test user using the config for the first user, is this expected behaviour?
Surely the reason why I assigned a cert to a perticular user was so that user had to marry up with the cert?
Or is this normal behaviour when OpenVPN is configured to auth as local users?

Sorry im just struggling to get my head around it.

Thanks in advance.

EDIT

Just noticed a setting called "Strict user CN matching" - I will try that and apologize in advance