MySQL Allows ODBC With Any Username
I strongly suspect this is not an issue of MySQL "not checking" the username, but rather permissions which are too broad.

Start with SELECT * FROM mysql.db WHERE Db = 'yourdb'; and ensure that only the desired permissions are set for your DB.