Reproducing the issue:

If the userID returns as <userID>c2W2LaORoGE1</userID> in the reponse, this is the actually encrypted ID for UserID = 0
 

In other words, the value would read as: <userID>0</userID>
 

There is no concern that the results are returning another user’s data

The encrypted ID of c2W2LaORoGE1 equates to 0.

This can be ignored; this is not another user’s ID appearing in the result.