Apparently complete strangers who are not even on your Steam Friends list can join your game, without your knowledge or permission. I was Alt-tabbed out to write some feedback for the forums, when I heard sounds of battle. Someone had taken control of Scarlett and was alternately shooting me, then healing me. It was apparently to get my attention.
The only friend who was currently playing D:OS said it wasn't them, so I have no idea who it was, and because of the lack of in-game chat, had no way to ask, or tell them things like "I have to go AFK now".