Contrary to what the javadoc indicates UserAuthenticatedEvent(UserReference) does not "match only events affecting the same user".