Why, if I use the authentication by user / password (Publisher) can I see the data sent in another BROKER without authentication?

[fandres]

629/5000
Hello friends, I am implementing a project that uses user / password authentication. The publisher is thus:
self.client_mqtt = MQTTClient (self.CLIENT_ID, BROKER, PORT, NAME, MQTT_PASS)

On the other hand the BROKER is running mosquitto, this works well. But I've done tests with another BROKER on my PC and another client on my PC with: mosquitto_sub -d -t / #
The problem is that the PC client and the PC BROKER shows the data.

Why, if I use the authentication by user / password (Publisher) can I see the data sent in another BROKER without authentication?
I am doing something wrong?

Micropython: 1.9.3 with ESP8266