External people can see private repositories? (!!)

I have a private repository in my team - the project, the repository and every setting has it set to Private.

I did a pull request and went in to view it. In the bottom right hand corner I can sometimes see the avatars of other people viewing the pull request at the same time as me.

However on a couple of occasions now, I've noticed avatars who are nothing to do with my team or organisation in the bottom right hand corner, when you hovered over them with the mouse pointer, it said "xxxxx is viewing this pull request" etc.

This is disconcerting!!! Either the notifications system is broken and reporting inaccuracies, or other people can see pull requests in my private repositories. Could you investigate please, is this a known bug?