The related.user field should be populated with any username or user identifier value found on an event, but the current description could use updated to reflect this intent better (like was done for the related.hosts field description).