it seems that this is a bug in EZ. If a user does not have any content read permissions at all, the limitationlist is set to false which again causes the sql limitation string to be empty. And an emtpy permission string means no restrictions.
It is roughly similar to this bug: http://ez.no/community/bugs/role_permissions_problem_fetching_information_without_permissions
so you might want to update this one with your information or create a new one.
A workaround should be to give the user a new role which has content read permissions limited to some obscure class which you never use (you might need to create such adummy class beforehand).
