Only "grant usage", but can still select, drop, create?
Most likely, your user5 has database (i.e. schema) privileges, just not server-wide privileges.  So look here.

USE app_db;
SHOW GRANTS FOR user5;


or check in the data dictionary for the same:

SELECT *
FROM INFORMATION_SCHEMA.SCHEMA_PRIVILEGES
WHERE GRANTEE LIKE '%user5%';


if not anything, then maybe also check

SELECT *
FROM INFORMATION_SCHEMA.TABLE_PRIVILEGES
WHERE GRANTEE LIKE '%user5%';