in your test, did the subscription actually run, and the unauthorized user actually successfully received it? I've seen instances where subscribed users don't have proper permissions, so the subscription fails.
Thanks for the reply. I guess my Test was just adding the user, but didn't click on the Subscribe button. You are right, the subscription fails if the user doesn't have permission. I was surprised I could see all the users though.