Users /
The user's own address. They can change it under Account. A new one is sent a link to confirm it; until it is confirmed no reset link goes to it.
Leave empty to keep the current one.
Everyone here is an administrator; the role is the reach. Global also sees Server and is the only one who adds or deletes domains. The only global user cannot be changed to domain or deleted.
Yours, the one you sign in with, not this user's. Asked when you add a user, or change a password, an e-mail or a role here: a session left open must not be enough to hand out an account.
With All ticked the single domains are ignored.
Granted separately from outbound: the same name on both lists is two assignments. The domain role needs at least one domain, or All, on either list.