A connection with “unauthenticated user” in the User column has initiated a connection but hasn’t sent his/her credentials yet, so the server doesn’t know who exactly is connecting.
If such connections only showed up in the list when they were authenticated, it could potentially run the server out of available sockets and you wouldn’t even know why.
Most often stuck connections are due to DNS not resolving properly, which the skip-name-resolve option will help with.
More info at the Pythian blog.