Correction: an API account can see all users that registered through the API with that account's key.

Still, WTF!?