When writing a comment anywhere within Bitbucket, typing '@' will always treat the adjacent word as a username, even if you don't know that user and he doesn't have access to your repositories.

If the user has access to your repository, he'll be displayed in a dropdown while you're typing, this is expected. However, if none of your team mates matches that username you won't see any dropdown, but in the moment you save the comment, whatever you were writing using '@' will be replaced by the name of the Bitbucket username who matches, if any (the users won't receive any notification as they don't have access to the repositories).

It would be nice that the saved comment will just display what you see while you're editing, and that it doesn't mention any random users without previous notice.

As a workaround, it's possible to avoid it by writing the word into a code block with backticks, like for example @whatever. This will scape the @mention and show just what you write.