New repository auto added groups with write access

I just created a new repository from within SourceTree on my Mac. A little later I got an email from a colleague that I worked with a year ago letting me know that he'd been given write access to the repository.

It turned out he was in a group that used to have write access to another repository.

I don't think new repositories should automatically be allocated to anyone other than the creator by default.