MySQL user with empty hostname
User whose name is joe can connect from any host.

Please note what MySQL 5.0 Certification Study Guide



say in its bulletpoints on Page 498 Paragraph 6:


  On Unix, MySQL comes with a mysql_secure_installation script that can
  perform several helpful security-related operations on your
  installation. The script has the following capabilities:
  
  
  Set a password for the root accounts
  Remove any remotely accessible root accounts.
  Remove the anonymous user accounts. This improves security because
  it prevents the possibility of anyone connecting to the MySQL server
  as root from a remote host. The results is that anyone who wants to
  connect as root must first be able to log in on the server host, which
  provides an additional barrier against attack.
  Remove the test database (If you remove the anonymous accounts, you
  might also want to remove the test database to which they have
  access).
  


That user needs to be removed immediately.

Simply run

DELETE FROM mysql.user WHERE host='';
FLUSH PRIVILEGES;


GIVE IT A TRY !!!

UPDATE 2017-02-01 17:07 EST

According to the MySQL Documentation on Access Control, Stage 2: Request Verification


  A '%' or blank Host value means “any host.”


This is applicable at all levels of grants.