I checked, the Online game visibility is set to "Nobody" and the in-game Session Settings is set to "Closed (default)" so I have no idea how this person joined the party.
In that case, rather weird. I've never had anyone join my games, but no doubt it could be some kind of a bug that allows that despite your selected options. In any case, I do agree that someone probably joined the game. That's the most probable answer.
