I'm back with some clues but no response

I looked in the software code and I found that users are collecting from the sysusers...