I have a second issue with this in that the users file has a defulat reject if the group is not matched. This also is not being used correctly by freeradius. The user defaults into that if there group does not match but does not get rejected.
I have never noticed any problems like that myself. I suspect you have something else in your users file that it is matching on. Perhaps a DEFAULT Auth-Type = something? Please post your users file in its entirety (you can remove the # lines if you would like for easier reading) Then post your radiusd -X output showing this behavior. That way you can read the debug info and look for a line that says something like "matched users file at 1". Without seeing the users file and the actual debug here its hard to say.