getent passwd reads an all-digit key as a uid, so a tool runner's account named "1000" resolved to whoever has uid 1000 and the entry went to them. Only an answer naming the account asked for is taken.